Version 1.21.1 - 2026-08-04
Fixed Issues
- Fixed an issue introduced in the previous release where components could remain stuck loading for integrations whose authentication endpoint restricts which request headers it accepts.
Version 1.21.0 - 2026-08-03
New features
Standard Bearer token authentication
The SDK now sends access tokens using the standardAuthorization: Bearer scheme, aligning UX Toolkit authentication with common OAuth 2.0 conventions and making it easier to integrate with auth tooling that expects a standard Bearer header.Optional dedicated OAuth endpoint for minting access tokens
bootstrap() now accepts an optional useDedicatedOauth flag. Set it to true to mint access tokens from Marqeta’s dedicated OAuth endpoint, giving your integration an isolated path for token issuance.This flag defaults to false, so existing integrations continue to work without any changes until you choose to opt in.New X-Source-Client header for request diagnostics
The SDK now sends anX-Source-Client header on outbound API requests, identifying the SDK type, platform, and version. This gives Marqeta Support more context when helping you troubleshoot integration issues, reducing back-and-forth when diagnosing request-level problems.Version 1.20.0 — 2026-07-07
Enhancements
Faster first load for iframe-backed components
Each iframe-backed component — including the card and its details, the transaction list, statements, account, and more — now preloads only its own code in parallel on first load. This collapses the cold-start network waterfall, so cardholders see a faster first view. No action is required — this is an automatic performance improvement with no API or behavior change.Faster startup for secure card components
The secure card components — card details, PIN, and CVV — now start up faster on first load by initializing earlier and fetching their setup data in parallel. This reduces the time cardholders wait to see sensitive card data. No action is required — this is an automatic performance improvement with no API or behavior change.Faster branding and connection setup on repeat loads
Your program’s branding now applies immediately on repeat loads, eliminating the flash of default styling before your branding appears. Network connections also open earlier, speeding up the first load. No action is required — this is an automatic performance improvement with no API or behavior change.Fixed issues
Duplicate load-completed events on failed loads
Marqeta fixed an issue wheremq-set-pin and mq-external-account-list emitted their load-completed event twice when a load failed. Each component now emits the event exactly once per load, so you can rely on the event count when tracking load outcomes.Version 1.19.1 — 2026-06-22
Fixed issues
- Marqeta fixed an issue that prevented authenticated mode from working correctly in Studio.
Version 1.19.0
New features
Faster, more reliable access token requests
Access token requests now time out after 5 seconds, with one automatic retry, instead of hanging indefinitely when a host app’s auth callback is unresponsive. This prevents a slow or unresponsive auth callback from blocking your app.No action is required. You can optionally listen for the newmqAuthCallbackTimeout event to detect when a timeout occurs.New lightweight loading spinner, smaller bundle size
UX Toolkit introducesmq-spinner, a lightweight CSS/SVG loading spinner that replaces the Lottie-based spinner used throughout the SDK. The new spinner matches the look of the legacy spinner — a gray-green arc with a white cap, rotating over one second, and pausing automatically when a cardholder’s device is set to reduce motion — and accepts size and color properties.The loading state of mq-button, mq-file-upload-file, and the statements download button now use mq-spinner instead of the Lottie-based animation. Because these components no longer reference the Lottie animation, the SDK removes the Lottie runtime (approximately 324 KB) from their bundles, including mq-button, which is on the mq-card critical path. This results in a faster load for mq-card and other components that use these elements.Lottie remains in place for the confetti, checkmark, and indeterminate-loader animations. This change doesn’t affect the public API of any existing component.Enhancements
Shared cardholder context across components
The SDK now fetches the cardholder context once per page load and shares it across all components, eliminating repeated requests. This reduces the number of API calls your integration generates when multiple components are on the same page.Deduplicated PAN reveal requests across iframes and WebViews
The SDK now deduplicatesGET /cards/{token}/showpan requests, so PCI card components fetch the value once and share the result across same-origin iframes and WebViews. This eliminates duplicate requests and reduces the number of calls made against a PCI-scoped endpoint.Version 1.16.0 — 29 April 2026
Minor changes
- Added an optional
state-filterproperty tomq-card-listfor restricting rendered cards to one or moreCardStateevents.
Patch changes
- Security enhancements.
Version 1.15.2 — 8 April 2026
Minor changes
- Added a Risk module and implemented the
postUserRiskLoginEvaluationinteractor.
Patch changes
- Fixed the radio description layout to render below the label.
Version 1.13.0 — 28 January 2026
Minor changes
- Added enhancements for the Know Your Business (KYB) onboarding Persons of Significant Control (PSC) form.
Patch changes
- Fixed an issue with internationalization strings (i18n) in the bootstrap function.
Version 1.12.0 — 14 January 2026
Minor changes
- Updated the KYB onboarding design.
Version 1.11.0 — 8 January 2026
Minor changes
- Extended the KYB onboarding flow to support the PSC form.
- Updated the following components to use i18n strings:
mq-accountmq-card-actionsmq-cardmq-replace-cardmq-link-external-cardmq-onboard-account-holder
- Enhanced logging and added a control that allows you to set the
logLevel.
Patch changes
- Updated the auto-generated
components.d.tsfile. - Security enhancements.