api-v1.1.0

[1.1.0] - 2026-06-22

Added

• Reliable account emails — Account emails — address confirmation, two-factor codes, and password-reset messages — are now delivered reliably, with automatic handling of bounced or rejected addresses.
• Self-service password reset — You can now reset a forgotten password from the sign-in screen through a secure email link. Accounts with two-factor authentication are asked to confirm their second factor during the reset.
• Two-factor authentication — Added optional two-factor authentication using an authenticator app, with single-use recovery codes for backup access.

Changed

• Clearer authentication responses — Authentication responses now use a consistent set of machine-readable codes, so apps can present clearer, more specific messages.
• Build metadata in the API documentation — The API's OpenAPI document now reports the release version and build date.

Security

• Hardened session handling — Signed-in sessions are more secure: refresh tokens now rotate automatically, with detection of reused tokens.
• Stronger sign-in protection — Sign-in and account-recovery flows are now protected against automated abuse, and accounts are temporarily locked after repeated failed sign-in attempts.