Security — Payload CMS plugins 12

Adds WebAuthn passkey login and management to Payload CMS accounts via Better Auth.

Adds Keycloak single sign-on to Payload CMS 3 via an OIDC auth strategy with PKCE, silent token refresh, and permission-based access control.

Automatic, compliance-ready audit logging plugin for Payload CMS that records an immutable change trail across every collection.

Sells digital products from a Payload store using signed, expiring download links that stop working when an order is refunded.

Adds full and partial refund records to Payload ecommerce orders, with per-line caps, optional restock, and an append-only audit trail.

Scans Payload upload collections for malware and secrets via the CypherScan API and blocks suspicious files before they persist.

Cookie banner, script gating and cookie declarations managed from the Payload admin panel.

Passwordless authentication for Payload CMS with passkeys, magic links, OAuth, and refresh-token sessions.

A plugin for Payload CMS that tracks events and enhances security.

Adds role-based access control to Payload CMS v3 with wildcard permissions, auto-generated permissions per collection, and a managed Roles collection.

RBAC plugin that generates user and role collections and injects fine-grained access control across Payload collections, globals, fields, and endpoints.

Applies default role-based access control to every Payload collection, granting CRUD access to specified roles such as admin and executive.