●Change8

Migrating to Hasura Auth v2.49.4

Version v2.49.4 introduces 1 breaking change. This guide details how to update your code.

Released: 7/8/2026

1
Breaking Changes
3
Migration Steps
6
Affected Symbols

⚠️ Check Your Code

If you use any of these symbols, you need to read this guide:

X-Hasura-Access-KeyX-Hasura-Admin-SecretHASURA_GRAPHQL_WEBSOCKET_QUEUE_SIZEhasura_websocket_messages_queued_totalhasura_websocket_messages_evicted_totalhasura metadata apply-data-sources

Breaking Changes

●Issue #1

The handling of the long-deprecated `X-Hasura-Access-Key` header has been removed. Clients must switch to using the `X-Hasura-Admin-Secret` header.

Migration Steps

  1. 1
    Clients relying on the `X-Hasura-Access-Key` header must update their requests to use the `X-Hasura-Admin-Secret` header instead.
  2. 2
    Users concerned about slow clients piling up websocket messages can set `HASURA_GRAPHQL_WEBSOCKET_QUEUE_SIZE` to a desired limit (e.g., 1 for freshest value pulling).
  3. 3
    Users with self-hosted identity systems should review their JWT configuration and consider enabling the 'extra_required_claims' option if they rely on issuer/audience validation.

Release Summary

This patch release introduces idempotency for server migrations, adds queue size limiting and monitoring for WebSockets, and introduces stricter JWT validation options. It also removes support for the deprecated X-Hasura-Access-Key header.

Need More Details?

View the full release notes and all changes for Hasura Auth v2.49.4.

View Full Changelog