Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Hi, has anyone noticed any regression going from `0.9.0-alpha.3` to latest `0.10.1` with verification flow. It says: `token has expired or has already been used` it worked completely fine with previous version. i updated the func signature for `submitSelfServiceVerificationFlow`, no need to pass undefined for session_token but not sure why it is failing.

it was very strange but i figured it out... I used a webhook after pwd registration and i manually updated the identity to change the metadata_public field. This screwed the flow or verification token somehow and it was invalid always for the first time. i guess ill have to wait for the webhooks to be able to modify metadata_public fields api that is upcomming...