Skip to main content
Veriqa 0.7.0 was published on October 31, 2026, and follows 0.6.1: it is the first package since then, so you upgrade from 0.6.1 straight to 0.7.0. The changes are described by development stage, 0.6.2 to 0.6.11; no packages were released under those numbers. The latest update is 0.7.1.

​
What’s in 0.7.0

​
What 0.7.0 itself adds

Changes from October 27 to 30, 2026.

​
Security

  • The sign-in question advises declining a request the user did not make. The shipped text ends with this paragraph: If it was not you, decline the request. You can replace it along with the rest of the text — see Veriqa:MessageTemplates. The wording of a server-to-server confirmation is yours, so add the paragraph there yourself.
  • In the server image with the shipped settings, the bot token and the hop link token no longer reach exported spans and logs. For a host of your own, see Observability and Security and data handling.
  • TransactionCompletedEvent on the RabbitMQ bus has no Subject, and prompt=none gets login_required. Both are covered in the upgrade section below.

​
Channels

  • A repeated delivery of an incoming event is dropped if it arrives at the same instance within 500 ms. Veriqa:Channels:InboundDeduplication:Window sets the window.
  • The name of any channel except Email is translated and overridden with the <name> | channel string.
  • The channel hint on the sign-in page is a message kind, hop-channel-hint.
  • The wording of a receipt follows ChannelCapabilities.RendersEmoji alone; the core no longer keeps a list of channels.

​
The sign-in page

A button with a long channel name no longer runs off a phone screen, and the buttons of the claims completion form stack in a column on a narrow screen.

​
Documentation

A new page, Messaging apps, email and account services. The 1C-Bitrix page now leads with the Veriqa module from the Marketplace.

​
What to check when you upgrade from 0.6.1

​
Storage

  • New EF Core migrations for the transaction store and the audit trail — apply them when you upgrade; see Storage.
  • A store of your own stops compiling: ITransactionStore has seven new members with no default implementation; see Upgrading a store of your own.
  • A prompt message store of your own stops compiling too: IChannelPromptMessageStore has three new members with no default implementation: FindAsync, TakeForChannelAsync and SetPhoneRequestMessageAsync.

​
Users and sign-ins

  • The sub of WhatsApp users changes. It was whatsapp:+number and is now whatsapp:{BSUID}, the ID Meta assigns per business portfolio. The number is no longer the identity: it stays in phone_number while WhatsApp sends it, and preferred_username carries the WhatsApp username. There is no migration: existing WhatsApp users get a new sub in your application.
  • Parallel sign-ins of one user: when a user starts a new sign-in and reaches the channel with the same account, that account’s unfinished sign-ins to the same application close. If your scenario keeps two sign-ins open at once, check it.
  • prompt=none gets login_required. Veriqa keeps no sign-in session, so such a request no longer opens the sign-in page: the error comes back to your redirect_uri. If your client renews tokens silently in a hidden iframe, switch it to a refresh token (the offline_access scope) — see OIDC and OAuth 2.0 support.
  • Email with LoginConfirmation.Mode = OnWebPage: the sign-in email no longer completes the sign-in; it only links the mailbox, and the sign-in page decides. “No” there gives declined_by_user.

​
Channels and events

  • A custom C# adapter stops compiling: GetDeepLinkAsync now takes a DeepLinkRequest instead of the transaction ID. The core calls it every time a channel is shown and every time a hop link opens, so keep it idempotent and free of side effects — see GetDeepLinkAsync.
  • ReportOutcomeAsync also receives awaiting_claims, which is not a final state. Check TransactionOutcomeNotice.IsTerminal before you show an outcome.
  • An adapter registered as telegram, whatsapp or max with RendersEmoji unset now gets the plain receipt. Set RendersEmoji = true to keep the emoji.
  • Public types in Veriqa.Core.ChannelAdapter.Pipeline have changed. If your code calls them directly, update the calls: for example, ChannelWebhookPipeline.ProcessInboundResultAsync is now ChannelInboundProcessor.ProcessAsync.
  • Phone numbers are accepted in E.164 only. A custom or HTTP adapter that reports a number in another form no longer passes it on. The rule is the public E164PhoneNumber in Veriqa.Core.Contracts.
  • TransactionCompletedEvent on the RabbitMQ bus has no Subject. The field carried the user’s sub in the clear — by default {channel_type}:{channel_user_id}. A subscriber can no longer identify the user from the bus message: Context.MaskedChannelUserId hides all but the last two characters and is not a key. If you need sub, read it in an ITransactionEventHandler in your host, which still receives Subject. See Storage.
  • The default MAX Bot API address is now https://platform-api2.max.ru. If your outbound traffic goes through an allowlist, add it — see MAX.
  • The new phrase in the sign-in question. Your own confirmation-prompt wording does not pick up If it was not you, decline the request. automatically: add it if you want it. Move a translation in a locale file to the new keys, which carry this phrase and the {requested_at} slot.

​
The sign-in page

  • ShowQrCode defaults to DesktopOnly instead of Always: a phone shows channel buttons instead of a QR code. To keep the old look, set "ShowQrCode": "Always".
  • The Cancel button appears on every sign-in page. If you built your own through CustomJsPath, remove it — or turn the built-in one off.
  • Title, Instruction and a channel hint already set as plain text may look different: these texts are now read as HTML. Terms &amp; Conditions now shows “Terms & Conditions”, and a bare < or > fails the check — the value is shown as written and a warning goes to the log. Review your values for &, < and >.
  • Some built-in texts are reworded — if you override them, check them against Configuration & customization.

​
Sign-in page wording

Your own wording for a built-in text in the table below, set in a locale file, no longer applies, because the previous keys are gone. Move it to the new key: A confirmation has the same keys with to confirm in {0} in place of to sign in with {0} and to confirm in place of to sign in. A replacement for a single-channel text must carry the {0} slot, where the page puts the channel’s icon and name. The full table of variants is in The instruction follows both settings.

​
0.7.1

Veriqa 0.7.1 was published on November 2, 2026. It changes how the pre-filled message reads in a confirmation and adds client apps to the quickstart repositories.

​
The pre-filled message of a confirmation

The message or email the user sends themselves no longer talks about signing in when the transaction is a confirmation. A message now says, for example, Send this message to continue., and an email has the subject Confirm in {app}: {token}, or Confirm: {token} without an application name. The one-tap email no longer names Veriqa in its subject or text; the application is named in the subject only. IChannelMessageTemplates.ResolveAsync, the post-login-* messages and the Email messages now also read ByType and ByAction, so a wording you set for a type or an action reaches them too.

​
Samples

The quickstart repositories have client apps in Python, Node.js, Go and PHP next to ASP.NET Core; each one uses a stock OpenID Connect library. See Sign-in on a website via a messaging app.

​
Docker image

The Docker image of this version runs on linux/amd64 and linux/arm64. Images of earlier versions are linux/amd64 only.

​
Public repository

The docs/ folder of the public repository is now gallery-and-docs/. The README of a package published up to 0.7.0 still points to the old path, so its images and the gallery link no longer open on the nuget.org page of that version.

​
What to check when you upgrade from 0.7.0

  • Your own deeplink-prefill wording. In Veriqa:MessageTemplates, a wording at the bare kind or for one channel now applies to sign-ins only. Word it for confirmations as well, at ByType:confirmation:BySurface:in-channel:ByChannel:{channel}. A channel of your own whose template carries {code} needs this address: without it, a confirmation gets the shipped text, which has no code — see Veriqa:MessageTemplates.
  • Your own locale files. The key of the one-tap email intro is now This mail confirms sign-in. Do not change the subject or the body of the mail., and a confirmation has new keys of its own — see The prefilled message text. Without a translation, they resolve to their English text.