Twingate Release Notes

Twingate Identity Firewall now supports HTTP web apps, allowing you to protect internal web apps, data portals, CI/CD infrastructure, and internally created AI-coded business apps with Twingate. Twingate authenticates users (enabling enhanced security through MFA, JIT access, security policies, and access logging) while improving user experience by removing the need to authenticate again once users reach your web apps.

To support a wide variety of web apps, ranging from legacy apps to new AI-coded apps, Twingate sends a JWT identifying the user, as well as custom headers with user and group attributes.

For more information on setting up this feature and integrating it into your web apps, see our documentation.

Admins can now assign a Helpdesk role to support staff who need to troubleshoot user and device issues but don't need full administrative access.

Users with the Helpdesk role get read-only access to certain Admin Console areas and the ability to perform support actions such as resetting MFA, verifying and unverifying devices, and managing trusted serial numbers.

This lets support teams unblock users without giving those teams broader administrative access.

For more information, see our documentation.

Resources can now be configured to bypass Twingate entirely. Admins can mark specific addresses within a broader Resource's scope, like a public sub-domain under a wildcarded corporate domain, to route directly to their destination via the local OS, skipping Twingate Connectors and Relay infrastructure. This gives you a clean way to carve out exceptions without restructuring your Resource topology or maintaining fragile, overlapping rules. Every change to a Resource's routing mode is captured in the audit log, so bypassing an address stays an explicit, traceable decision rather than a blind spot.

For more information, see our documentation.

You can now register servers and VMs as SSH Resources in Twingate. Users can connect to these Resources using their existing tools and authenticate with their identity provider. Admins no longer have to manage SSH keys or distribute them to users. The Twingate Gateway handles certificate-based authentication to the target server and records every session to stdout in asciicast format, ready to forward to your SIEM or to replay for audit purposes. With Privileged Access via the Twingate Identity Firewall, you can eliminate credential sprawl and the need for bastion hosts, all without changing your developers' workflows.

For more information, see our documentation.

We now make available summaries of network health as a downloadable reports. These summaries provide metrics like data transferred and errors over specified timeframes, giving admins better insight into network performance.

Additionally, existing active user reports have been extended to provide similar data points on a per-user level, making it easier for admins to proactively monitor the health of their networks and efficiently troubleshoot issues.

For more information, see our documentation.

The Twingate Linux Client now features a userspace networking mode that eliminates the need for the Client to run with root access or elevated privileges. By using the new HTTP Proxy Mode, users can securely connect to Twingate-protected resources using standard HTTP/HTTPS connections, even in restricted or headless environments. This enables DevOps to seamlessly integrate Twingate into CI/CD pipelines, Docker containers, and developer workstations where admin access is typically unavailable, drastically simplifying deployment.

For more information, see our documentation.