Latchkey
ProductDocsChangelog
Sign inConsole

Changelog

What shipped.

  1. auth

    Session links, passkeys, and magic links hardened

    Product-minted sign-in links redeem at /oauth/go and are single-use, expiring and revocable (PR #45). Passkeys sign people in and enrol after a magic-link sign-in, with a hosted management page (PR #34). Magic-link tickets are hashed at rest, so nothing stored is a live link, and the confirm page consumes on POST so mail scanners cannot burn one (PR #44). Refused sign-ins are recorded and shown on the console’s Attempts page (PR #40).

  2. org api

    Org API indexes, paging and delivery visibility

    Clients, members, sessions and users are single filtered queries with ?limit=&offset= instead of registry scans. GET /org/{slug}/mail/activity folds the login-ticket log into per-email created / sent / consumed / expired rows, so “sent 2m ago — not used” is answerable without ticket ids.

  3. mail

    Per-org email templates

    Login and invite emails are per organisation: a strict variable allowlist, the link injected by the service, and a console editor with a variable-aware preview. Sender credentials live in org settings, sealed under KMS, with the platform sender as the fallback.