Summer 2026 Changelog

This summer was a busy one for the platform: Web Elements v3 reached general availability, Agentic Payments launched as a new API for giving AI agents bounded authority to pay, Reactors gained asynchronous execution on the new runtimes platform, and the Customer Portal picked up meaningful upgrades.

Here's what shipped.

Web Elements v3 Is Now Generally Available 

Web Elements v3 is out of preview and generally available for production use. v3 is a ground-up rebuild of the Elements architecture that makes checkout forms faster to load and to tokenize, while keeping sensitive card data isolated from your page. In our benchmarks, v3 loads and tokenizes faster than comparable offerings from Stripe, Adyen, VGS, and Braintree. 

The GA release rounds out the v3 feature set: a combined card element that captures the card number, expiration date, and CVC in a single mount; built-in co-badged card support (the coBadge option lets cardholders pick their network, reported through selectedNetwork); and white-label hosting on your own custom domain. Under the hood, each element ships as a single self-contained iframe bundle, which means faster initial rendering and lower-latency tokenization, especially on slower devices and networks.

Why this matters:

1. Checkout speed directly affects conversion, and v3 removes latency from both the first render and the tokenization call.
2. The combined card element and richer change events mean less integration code for the most common use case.

Head to developers.basistheory.com to get started with v3, including the migration guide from v2.

Return to Top

Asynchronous Reactors on the New Runtimes Platform 

You can now run Reactors asynchronously on the modern runtimes platform. Instead of holding a request open while your code executes, you submit an invocation, Basis Theory queues and runs it durably, and you retrieve the result from a resolution endpoint when it completes.

Async execution is configurable via the API and CLI and offers full feature parity with synchronous Reactors on the node-22 runtime.

Request state is durable end-to-end, so results survive retries and transient failures, and structured error responses make handler failures debuggable rather than opaque. The runtimes platform also added node-24 support this month across the API, provisioning, and the CLI, so new Reactors can target the current Node LTS line.

With this milestone, every Reactor on modern runtimes gets tenant isolation by default, ephemeral execution, customer-managed dependencies with vulnerability scanning, and per-tenant concurrency limits.

Why this matters:

1. Long-running work like batch tokenization, enrichment, and third-party API orchestration no longer has to fit inside a synchronous request window.
2. Durable request state means a transient failure doesn't silently drop an invocation; you can always resolve the outcome.
3. Targeting node-22 and node-24 keeps your Reactor code on supported, patchable runtimes.

Learn more in the async Reactors documentation.

Return to Top

Agentic Payments: A New API for Agentic Commerce 

Agentic Payments is a new API for giving an AI agent bounded authority to pay, replacing the previous agents, enrollments, and instructions model.

You register an existing source, such as a card token in your vault, as a payment method, and it's provisioned with every rail the source supports in one call:

• Visa Intelligent Commerce

• Mastercard Agent Pay

• Stripe Shared Payment Tokens

The customer approves an allowance, a spending mandate with an amount, description, expiration, and optionally a merchant. Verification happens once on the allowance rail you intend to mint from, instead of the two ceremonies the previous model required, and ceremonies run entirely on your own pages through the Web Agentic SDK, with no provider branching or hosted popups. From an allowance, the agent mints single-use credentials in the format the rail calls for (one-time virtual card, network token, processor token, or MPP payload), and the allowance tracks its own balance so concurrent mints can never overspend the mandate.

With this release, the previous Agentic Commerce API is deprecated. Existing integrations continue to work and receive bug and security fixes, but new capabilities land only in Agentic Payments; see Migrating to Agentic Payments for cutover guidance.

Why this matters:

1. Customers verify once and approve a single purchase mandate, not open-ended agentic access to the card.
2. One integration covers the card network agentic programs and processor shared payment tokens, with supported rails and formats reported on the resource instead of being branched in your code.
3. New rails, providers, and credential formats arrive as data on existing resources, so supporting a new payment surface doesn't mean another rewrite.

Return to Top

Customer Portal Identity Provider Revamp 

The Identity Provider (SSO) pages in the Customer Portal have been rebuilt with a modernized design and new backing infrastructure, making it clearer to configure how your team signs in to Basis Theory.

Sign-in itself has improved alongside it. And for organizations using SSO, the new identifier-first login includes an escape hatch so users who also hold a password-based account can still reach it when they need to.

Why this matters:

1. SSO configuration is usually an admin's first security task in the portal, and it's now faster and less error-prone.
2. OTP-based email verification is a smoother, more reliable flow than link-based verification.

Return to Top

Apple Pay Sandbox Support in Test Tenants 

You can now tokenize sandbox Apple Pay payment methods through the Apple Pay APIs. Sandbox tokens are accepted in Test Tenants only, so you can exercise your full Apple Pay flow end to end, including with your own merchant certificates, before going live. See Testing with Apple Pay Sandbox to get started.

Return to Top

Java SDK Now Available on Maven Central 

The Java SDK is now published to Maven Central. Previously, it was distributed only through GitHub Packages, which required authentication just to download the dependency. You can now add the SDK to your build like any standard Maven or Gradle dependency, with no extra credentials.

Return to Top