> ## Documentation Index
> Fetch the complete documentation index at: https://www.marqeta.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# 2026

<Update label="August 2026">
  ## Version 1.21.1 - 2026-08-04

  ### Fixed Issues

  * Fixed an issue introduced in the previous release where components could remain stuck loading for integrations whose authentication endpoint restricts which request headers it accepts.

  ## Version 1.21.0 - 2026-08-03

  ### New features

  #### Standard Bearer token authentication

  The SDK now sends access tokens using the standard `Authorization: Bearer` scheme, aligning UX Toolkit authentication with common OAuth 2.0 conventions and making it easier to integrate with auth tooling that expects a standard Bearer header.

  #### Optional dedicated OAuth endpoint for minting access tokens

  `bootstrap()` now accepts an optional `useDedicatedOauth` flag. Set it to `true` to mint access tokens from Marqeta's dedicated OAuth endpoint, giving your integration an isolated path for token issuance.

  This flag defaults to `false`, so existing integrations continue to work without any changes until you choose to opt in.

  #### New X-Source-Client header for request diagnostics

  The SDK now sends an `X-Source-Client` header on outbound API requests, identifying the SDK type, platform, and version. This gives Marqeta Support more context when helping you troubleshoot integration issues, reducing back-and-forth when diagnosing request-level problems.
</Update>

<Update label="July 2026">
  ## Version 1.20.0 — 2026-07-07

  ### Enhancements

  #### Faster first load for iframe-backed components

  Each iframe-backed component — including the card and its details, the transaction list, statements, account, and more — now preloads only its own code in parallel on first load. This collapses the cold-start network waterfall, so cardholders see a faster first view. No action is required — this is an automatic performance improvement with no API or behavior change.

  #### Faster startup for secure card components

  The secure card components — card details, PIN, and CVV — now start up faster on first load by initializing earlier and fetching their setup data in parallel. This reduces the time cardholders wait to see sensitive card data. No action is required — this is an automatic performance improvement with no API or behavior change.

  #### Faster branding and connection setup on repeat loads

  Your program's branding now applies immediately on repeat loads, eliminating the flash of default styling before your branding appears. Network connections also open earlier, speeding up the first load. No action is required — this is an automatic performance improvement with no API or behavior change.

  ### Fixed issues

  #### Duplicate load-completed events on failed loads

  Marqeta fixed an issue where `mq-set-pin` and `mq-external-account-list` emitted their load-completed event twice when a load failed. Each component now emits the event exactly once per load, so you can rely on the event count when tracking load outcomes.

  ## Version 1.19.1 — 2026-06-22

  #### Fixed issues

  * Marqeta fixed an issue that prevented authenticated mode from working correctly in Studio.

  ## Version 1.19.0

  ### New features

  #### Faster, more reliable access token requests

  Access token requests now time out after 5 seconds, with one automatic retry, instead of hanging indefinitely when a host app's auth callback is unresponsive. This prevents a slow or unresponsive auth callback from blocking your app.

  No action is required. You can optionally listen for the new `mqAuthCallbackTimeout` event to detect when a timeout occurs.

  #### New lightweight loading spinner, smaller bundle size

  UX Toolkit introduces `mq-spinner`, a lightweight CSS/SVG loading spinner that replaces the Lottie-based spinner used throughout the SDK. The new spinner matches the look of the legacy spinner — a gray-green arc with a white cap, rotating over one second, and pausing automatically when a cardholder's device is set to reduce motion — and accepts `size` and `color` properties.

  The loading state of `mq-button`, `mq-file-upload-file`, and the statements download button now use `mq-spinner` instead of the Lottie-based animation. Because these components no longer reference the Lottie animation, the SDK removes the Lottie runtime (approximately 324 KB) from their bundles, including `mq-button`, which is on the `mq-card` critical path. This results in a faster load for `mq-card` and other components that use these elements.

  Lottie remains in place for the confetti, checkmark, and indeterminate-loader animations. This change doesn't affect the public API of any existing component.

  ### Enhancements

  #### Shared cardholder context across components

  The SDK now fetches the cardholder context once per page load and shares it across all components, eliminating repeated requests. This reduces the number of API calls your integration generates when multiple components are on the same page.

  #### Deduplicated PAN reveal requests across iframes and WebViews

  The SDK now deduplicates `GET /cards/{token}/showpan` requests, so PCI card components fetch the value once and share the result across same-origin iframes and WebViews. This eliminates duplicate requests and reduces the number of calls made against a PCI-scoped endpoint.
</Update>

<Update label="June 2026">
  ## Version 1.18.0 — 3 June 2026

  ### Minor changes

  * Added an Environment dropdown to Studio authenticated mode. You can now select a Production or Sandbox environment when routing API requests.
  * Added customer-uploaded translation overrides in the sandbox environment.

  ### Patch changes

  * Security enhancements.
</Update>

<Update label="May 2026">
  ## Version 1.17.1 — 19 May 2026

  ### Patch changes

  * Fixed copy buttons on `mq-pan`, `mq-cvv`, and `mq-expiry` to correctly write the card number, CVV, and expiration date to the clipboard.
  * Security enhancements.

  ## Version 1.17.0 — 6 May 2026

  ### Minor changes

  * Added Finnish (fi-FI) locale support.
</Update>

<Update label="April 2026">
  ## Version 1.16.0 — 29 April 2026

  ### Minor changes

  * Added an optional `state-filter` property to `mq-card-list` for restricting rendered cards to one or more `CardState` events.

  ### Patch changes

  * Security enhancements.

  ## Version 1.15.2 — 8 April 2026

  ### Minor changes

  * Added a Risk module and implemented the `postUserRiskLoginEvaluation` interactor.

  ### Patch changes

  * Fixed the radio description layout to render below the label.
</Update>

<Update label="March 2026">
  ## Version 1.15.1 — 25 March 2026

  ### Minor changes

  * Updated types for the `ProvisionWalletResponse` event.

  ### Patch changes

  * Security enhancements.

  ## Version 1.14.0 — 2 March 2026

  ### Minor changes

  * Added new components for the primary account number (PAN), CVV, and expiration date.
</Update>

<Update label="January 2026">
  ## Version 1.13.0 — 28 January 2026

  ### Minor changes

  * Added enhancements for the Know Your Business (KYB) onboarding Persons of Significant Control (PSC) form.

  ### Patch changes

  * Fixed an issue with internationalization strings (i18n) in the bootstrap function.

  ## Version 1.12.0 — 14 January 2026

  ### Minor changes

  * Updated the KYB onboarding design.

  ## Version 1.11.0 — 8 January 2026

  ### Minor changes

  * Extended the KYB onboarding flow to support the PSC form.
  * Updated the following components to use i18n strings:
    * `mq-account`
    * `mq-card-actions`
    * `mq-card`
    * `mq-replace-card`
    * `mq-link-external-card`
    * `mq-onboard-account-holder`
  * Enhanced logging and added a control that allows you to set the `logLevel`.

  ### Patch changes

  * Updated the auto-generated `components.d.ts` file.
  * Security enhancements.
</Update>