[ AxiomCore · Documentation ]
Upgrade to the November 2026 Axiom Cloud release
Move from Axiom CLI 0.149 to 0.151, understand the automatic authentication table upgrade, and turn on the new opt-in database and authentication features one environment at a time.
This guide is for projects that already use Axiom Cloud with CLI 0.149.x. It covers three changes: the CLI version, the managed authentication tables, and the features that stay off until you turn them on.
Before you start
- Note your current CLI version with
axiom --version. - Commit your project, including
.axiomlock files. - Have an Owner of the Cloud project available: several new features need an Owner and a recent sign-in (step-up).
Upgrade the CLI from 0.149 to 0.151
CLI 0.150.0 was never published. Go straight from 0.149.1 to 0.151.0.
Re-run the installer script with the version pinned:
curl -fsSL https://axiomcore.dev/install | VERSION=0.151.0 bash
axiom --versionIf you installed with Homebrew on macOS, run brew upgrade AxiomCore/tap/axiom
after the formula is updated to 0.151.0. See
Install the Axiom CLI for checksums and
platforms (macOS arm64; Linux amd64 and arm64 with glibc 2.36 or newer).
What 0.151.0 adds for Cloud projects:
| Area | New in 0.151.0 |
|---|---|
| Hosted migrations | axiom database migrate, status, history, rollback and diff accept --project and --environment; axiom database pull downloads the applied hosted history; releases are signed by project signers |
| Runtime data | Storage backed by a hosted database compiles to its hosted profile; server package --environment seals the environment into container releases |
| Authentication | axiom auth configures providers and settings, OAuth apps, MFA status, webhooks and hooks, policy releases and axiom auth emulate |
| Data tools | Signed release impact reports; pull merges changes captured in the Dashboard and refuses conflicting edits |
| Recovery | axiom project resources recovery shows the restore window, backups and archive state; axiom login --step-up |
| Branches and placement | axiom branch, placement, move receipts and axiom db convert |
| Security | Errors no longer echo evaluated configuration that could contain secret values |
Existing commands keep their behavior. Re-run your build after the upgrade so generated runtime configuration records the new contract versions.
Authentication tables upgrade automatically
Managed authentication stores its tables in your environment's database. The November release adds tables for MFA, passkeys, OAuth applications, webhooks, phone codes and captured branch mail. Axiom upgrades them for you:
- An environment upgrades when you first turn on one of the new authentication features, and later for every environment during a scheduled upgrade. You do not run a migration.
- The upgrade adds tables only. Existing users, passwords, sessions and roles are unchanged.
- On SQLite the upgrade runs in one short transaction. A sign-in that meets it is retried once; in the rare case it still fails, the user sees a temporary error and can try again.
- Until an environment is upgraded, the new features answer
AXAUTH_UPGRADE_PENDING. Saving a setting that needs the upgrade returns"upgrade_pending": trueand starts it.
Your own migrations never touch these tables, and the upgrade never touches your application tables.
Frontends that use MFA, passkeys or step-up
Programs that use MFA, factors, passkeys or step-up operations select the
axiom.auth/v2 frontend contract when built with CLI 0.151. Use web UI Host
0.8.0 or @axiomcore/auth-web 0.2.0 with them. Programs that use only
password, email code, magic link or social sign-in keep working with the
earlier host and SDK.
Opt in to the new features
Each new feature is off for every environment until it is turned on, and some need an Owner and a Pro project.
| Feature | How to turn it on | Status |
|---|---|---|
| OAuth applications and the OIDC issuer | Per environment, Owner | Alpha |
| Authenticator apps, recovery codes and passkeys | Per environment, Owner | Alpha |
| Webhooks and claim hooks | Per environment, Owner | Alpha |
| Phone verification | Per environment, Owner, Pro, your own Twilio account | Coming soon |
| Microsoft sign-in and third-party presets | Per environment, Owner | Coming soon |
| Preview branches | Per project, after admission | Alpha, selected projects |
| SQLite to PostgreSQL conversion | Per database, Owner, Pro | Alpha, selected projects |
| Moves between pools and regions | Owner consent for each move | Alpha, selected projects |
| Your own Turso database | Per environment, Owner | Coming soon |
Turn features on in one environment first, such as a staging environment, check your application, then repeat for production.
Roll back
- CLI. Reinstall 0.149.1. Projects built with 0.151 that use the new frontend contract need a rebuild with 0.149.1.
- Authentication tables. The upgrade is not reversed. Turning a feature off stops it; the added tables stay empty or unused.
- Features. Turn each feature off per environment. Data created by a conversion or a move stays where it is.
Next steps
Axiom Cloud security model
How Axiom Cloud separates identities, isolates projects and environments, handles database and signing credentials, and what a restore does to sessions and permissions.
Axiom Cloud platform changes
What the October and November 2026 Axiom Cloud platform release added for managed databases, authentication, data tools, recovery and operations, with the status of each change.