We recently launched Browser Tokens, a new way for AI agents and automated browsers to complete checkout without touching real card data. Agents only enter tokens into payment forms, and Evervault's proxy swaps in the real card details as the request goes to the merchant. Check out our blog post and docs for more information.

You can now attach correlation IDs to API and Relay requests to trace them in your own logs. This makes it easier to tie requests to Evervault with events in your own systems, and to trace requests across systems.

We also added a new section to the docs for troubleshooting 3DS failures. There's now a step-by-step process, as well as a search box you can use to quickly find and understand failure reasons.

eMudhra certificate incident

On 19th October, the private keys for eight eMudhra intermediate certificates were found to be compromised, which could let an attacker forge a certificate for any domain. Evervault's services no longer trust these certificates, and the incident report has the full details.

Evervault can't update certificates in code that you control. If you use Functions or Enclaves, make sure you've completed the steps below.

Functions

Evervault updated the certificate store of the Function runtime. This doesn't cover certificates that your code or its dependencies include, such as the Python certifi package.

1. Update the affected packages listed in the Python advisory.

2. Move your Functions to a current runtime: Node.js 22, 24, or 26, or Python 3.13 or 3.14.

3. Redeploy your Functions.

Enclaves

Enclaves need a data plane update and a rebuild.

1. Update the Enclave data plane to 1.4.2.

2. If your Enclave uses network egress, update the certificate store in your Enclave base image and any certificate packages in your application.

3. Rebuild and redeploy your Enclave.

New and upcoming features

• Visa DCAP is a program that reduces interchange fees for eligible transactions using Visa’s Data Only authentication flow. By sending enriched transaction data for risk assessment instead of a full 3DS challenge, it enables a frictionless checkout experience while lowering merchant costs. 

• Card Collection components have been updated to be more composable, customizable, and faster. You can rearrange fields, add custom fields, and more. These changes are non-breaking, so you can pull them in when you want.

• Network Retry Signals give you stronger signals for when to retry declined transactions, helping you to recover lost revenue.

• Real-time Account Updater will ensure you have the latest card number and expiration date for customers' cards. It’ll help maintain seamless billing without customers manually updating their card details. This results in higher authorization rates and reduced friction for customers.

Improvements and fixes

• Launched Browser Tokens

• SDKs

  • Added type="password" to custom card fields to mask values as the customer types, across <ev-field>, React, and React Native

  • Added custom error messages and prefilled cardholder name and custom field values to the React Native software development kit (SDK) (@evervault/react-native@2.8.0)

• API

  • Added correlation IDs for API and Relay requests through a traceparent header that follows the W3C Trace Context specification

  • Added the externalCustomerReference attribute to API request bodies for passing correlation IDs

• Payments

  • Added a /simulate endpoint for testing Network Retry Signals on sandbox apps, which sends retry-now signals to a webhook subscribed to the payments.network-retry-signals.signal event

  • Added optional networkMid and network attributes to the simulate endpoint for testing Mastercard and Visa signal handling, described in the Network Retry Signals testing docs

• Docs

  • Added a troubleshooting 3DS failures section with a searchable error lookup, step-by-step guidance, and tables of failure codes, meanings, and suggested fixes

  • Minor updates and fixes across docs