September 2026 Changelog

Busy month! 

AI agents can pay from a shopper's Stripe Link wallet, not only from a card in your vault. Elements now render right-to-left for Arabic and Hebrew checkouts, and you can turn on Network Tokens, Account Updater, and 3D Secure in a test tenant without opening a support request. Webhooks now cover the agentic payment lifecycle and carry runtime logs from your Reactors and Proxy transforms, and you can move a custom hostname between Proxies through the API.

Rounding out the month are improvements toElements, React Native, Proxy, 3D Secure, and network tokens, plus fixes across Proxies, Reactors, 3D Secure, network tokens, and the Portal.

Fund Agentic Payments From a Shopper's Stripe Link Wallet 

You can now let an AI agent pay from a shopper's Stripe Link wallet instead of a card stored in your vault.

A connection links a shopper's Stripe Link account to your tenant. The shopper authorizes it once, and the payment method it backs works like any other in Agentic Payments: you create allowances against it with an amount, a description, and an expiration, and the agent mints a credential against the allowance when it is ready to buy. Connections have their own lifecycle.

You can re-authorize one when the shopper's consent needs refreshing and revoke it when the shopper asks you to.

Why does this matter?

1. Shoppers who already keep their cards in Stripe Link can fund agent purchases without entering card details again.
2. The agent flow is the same whether the payment method is a vaulted card or a connected wallet, so you maintain one integration.
   
   

Available on request. Contact your account team to enable it for your tenant.

Return to Top

Render Elements Right-to-Left for Arabic and Hebrew 

You can now render v3 Web Elements right-to-left for checkouts in Arabic, Hebrew, and other right-to-left languages.

Set the new direction option to rtl when you initialize Elements, alongside themeMode. The default stays ltr, so existing integrations do not change. In right-to-left mode, field alignment, placeholders, the card brand picker, the order of fields inside the card element, and icon placement all flip to match the page.

Card numbers, expiration dates, and security codes still read left-to-right inside their fields, which is how cardholders in right-to-left markets expect to see them.

Why does this matter?

1. Shoppers in right-to-left markets get a checkout that matches the rest of your page instead of a form that reads backward.
2. One option switches the whole card form, so you do not restyle individual fields.

Learn more in the right-to-left documentation.

Return to Top

Switch On Features in Test Tenants 

You can now turn Network Tokens, Account Updater, and 3D Secure on and off in a test tenant from the Portal, without a support request.

Open your test tenant's Quotas page under Settings and switch on the features you want to evaluate. They are available in your sandbox right away, so you can build and test an integration on day one. Production entitlement still follows your contract, so enabling a feature in a test tenant does not change what your production tenant can do.

Why does this matter?

1. You can evaluate network tokenization, account updating, and 3D Secure end-to-end before you talk to anyone.
2. Sandbox setup no longer waits on a ticket, so the first day of an integration is spent integrating.

Return to Top

Webhook Updates

Subscribe to Agentic Payment Events Through Webhooks 

You can now subscribe to webhook events for the agentic payment lifecycle and react to them in your backend instead of polling the API.

Events fire when a payment method is created or deleted, when an allowance is created, updated, or deleted, when a payment rail retries, when a cardholder completes verification, and when a payment credential is minted. Subscribe to them the same way you subscribe to any other Basis Theory webhook event.

Why does this matter?

1. Your backend learns about allowance and credential changes as they happen, without a polling loop against the API.
2. Verification and retry events give you a timeline of what the agent and the cardholder did, which simplifies support and reconciliation.

See the full list in the webhook event data reference.

Receive Reactor, Proxy Runtime Logs Through Webhooks 

You can now receive the logs your Reactor and Proxy transform code writes as webhook events, so you can see what your code did on every invocation.

Turn logging on per Reactor or Proxy transform by setting runtime.logs.enabled and choosing a level: debug, info, warn, or error. Basis Theory delivers the output as reactor.log and proxy.log webhook events, which you can route to your own logging or observability tools. The events also tell you when a failure came from your application code and when it came from the platform, such as a timeout or an out-of-memory stop, which was hard to tell apart before. Runtime logs are available on Node.js runtime images, not on node-bt.

Why does this matter?

1. You can debug a Reactor or transform from your own logs instead of reproducing the call or opening a support request.
2. Platform failures and application failures are labeled differently, so you know whether to fix your code or your resource limits.

Learn more in the runtime logs documentation.

Available on request. Contact your account team to enable it for your tenant.

Return to Top

Move a Custom Hostname Between Proxies Without Downtime 

You can now point a custom hostname at a different Proxy through the API, which lets you roll out a new Proxy behind an existing hostname and roll back just as quickly.

Create the replacement Proxy, test it using its Proxy Key, then transfer the hostname to it with the transfer hostname endpoint. Traffic moves immediately, and your callers keep using the same hostname. If something is wrong, transfer the hostname back to the original Proxy. The server SDKs include the method, starting with Node 6.2.0, .NET 8.2.0, Java 8.2.0, Python 7.2.1, and Go 7.2.0.

Why does this matter?

1. Blue/green deployments for Proxies no longer need a DNS change or a request to support.
2. Rollback is a second API call, so you can migrate during business hours.

Learn more in the Pre-Configured Proxies documentation.

Available on request. Contact your account team to enable it for your tenant.

Return to Top

Improvements 

Elements: Full BIN Details on v3 Card Events

Card and card number change events in v3 Web Elements now include binDetails for every card, with the brand, funding type, issuing bank, issuer country, and segment, matching what v2 and the mobile SDKs already return. See the v3 events reference.

Elements: Hide the Card Brand Icon or Show the Security Code

You can now set iconPosition: 'none' on the card number element to hide the brand icon while co-badge events and setNetwork() keep working, and set conceal: false on the CVC element to show the code as the shopper types. Defaults are unchanged. See the v3 components reference.

Elements: Send Card Data to a Second Destination From v3

Set allowHttpClient: true when you initialize v3 Web Elements to send element data to a third-party endpoint alongside tokenization with Basis Theory. Destinations must be allowlisted by Basis Theory, the destination's response is returned to your page unmodified, and failures surface as a distinct HTTP client error. See the v3 services reference.

Elements: Set the Mobile Keyboard's Enter Key Label

Web Elements accept an enterKeyHint option (next, done, go, search, or send) so the mobile keyboard's action key matches where the shopper is in your form. Card options also accept cvv as an alias for cvc. See the v3 components reference.

Elements: Configure Card Display Layout, Labels, and Sizing

The card display element now takes custom field labels, renders fields stacked or inline, hides the reveal control with showToggle: false, and reports its height to the host page so you can size the container. See the v3 components reference.

React Native Elements: Native Autofill and Keyboard Props

React Native Elements forward autoComplete (cc-number, cc-exp, cc-csc), textContentType, inputAccessoryViewId, returnKeyType, and enterKeyHint to the native inputs, so platform autofill and keyboard behavior work inside card fields. Available now in react-native-elements 4.2.0 and 3.1.0 for the v3 LTS line. See the React Native components reference.

React Native Elements: Built-In Card Brand Icons

CardNumberElement now shows a built-in brand icon as the shopper types, with an iconPosition prop to place or hide it. Available now in react-native-elements 4.4.0. See the React Native components reference.

Proxy: Webhook Events Report Which Fields Were Detokenized

The proxy.invoked event now includes a detokenization object with the number of expressions Basis Theory substituted in the request body and the fields they appeared in, so you can audit what a Proxy call revealed without the values. Failed detokenizations report zero substitutions with the reason on the error event. See the webhook event data reference.

3D Secure: Alphabetic Currency and Country Codes

Authentication requests now accept ISO 4217 alphabetic currency codes such as USD and ISO 3166-1 alpha-2 or alpha-3 country codes such as US or USA alongside the numeric codes, and exponent is optional. An unsupported alphabetic code returns a 400 that names the field. See the 3DS sessions reference.

Return to Top

Bug Fixes 

Proxy: Transforms That Omit a Status Code No Longer Return a 502

A Proxy transform that left out statusCode, which the contract allows, caused the edge to return a generic 502 instead of your response. The destination's status now passes through as documented.

Proxy: Updating Transform Code Keeps the Runtime

Updating a Proxy's transform code without restating the runtime block no longer moves a node22 or node24 Proxy back to node-bt. The Proxy stays on the runtime it was configured with, so a code edit no longer breaks it.

Proxy: Response Fields Are Masked Individually in Webhook Events

The destination response body on proxy.invoked events arrived as one masked string. It now keeps its field names with each value masked, matching how the request body was already handled, so you can see which fields your destination returned.

Proxy: Invalid Requests Return a 422 Instead of a 500

A Proxy request that failed because the request was malformed or because your transform code threw returned a 500. It now returns a 422, so the response tells you the problem is in the request or the transform. Platform failures still return a 5xx.

Reactors: Long-Running Async Executions Return Their Results

Async Reactor executions that ran longer than about six minutes finished their work but reported an unexpected error to the caller. They now return their actual results, and the 10-minute execution limit is unchanged.

3D Secure: Shorthand IPv6 Addresses No Longer Cause Rejections

Some European issuers rejected authentications when the shopper's IPv6 address was sent in shorthand form. Basis Theory now writes the address out in full before the request leaves, with no change on your side.

3D Secure: Discover Authentications Use a Stable Requestor ID

When a Discover merchant did not supply a requestor ID, Basis Theory generated one from the merchant's display name, which could exceed the 35-character limit and cause the authentication to be rejected. Discover authentications now use the requestor ID you set for each sub-merchant, and an over-length value is rejected up front with an error that names the field. Set the Discover requestor ID on each authentication request to the short ID registered with Discover.

Network Tokens: Deduplicated Provisioning Returns the Token You Sent

A provisioning request that matched a network token already in your vault could return a different card's token_id. It now returns the token you sent, links it to the existing network token, refreshes the stored card details, and publishes an event. If you stored token_id values from earlier responses, re-verify them against _extras.network_token_ids on GET /tokens/{id}.

Return to Top