Changelog
What's new in Token Vault — OAuth 2.1 for MCP clients, the TypeScript reference webhook, activity log, and the move to webhook-sovereign-only architecture.
Product updates, newest first. Longer write-ups live on the blog.
July 2026
- Quickstart + docs refresh — new ten-minute quickstart fronted by the Cloudflare Workers reference webhook, honest setup estimates, and a documentation-wide accuracy pass.
- TypeScript reference webhook — the multi-runtime reference implementation (Cloudflare Workers, Cloud Run, Deno) is now the recommended production data plane: HKDF seed-derived keys, D1 storage, AES-256-GCM at rest.
- OAuth 2.1 authorization server for MCP — Claude, ChatGPT, Cursor, and any MCP client can connect with a standard in-client OAuth flow: dynamic client registration (RFC 7591), PKCE S256-only, revocation and introspection. Read the announcement · docs.
June 2026
tv_sessionproxy auth — MCP proxies can inject an auto-refreshing Token Vault session token as upstream auth, for gating your own self-hosted MCP servers with Token Vault identities and policies.- Activity log — in-app activity feed and usage rollups, readable even when your webhook is offline (metadata only — credential events stay on your webhook).
- Webhook-sovereign only — the legacy hosted-storage mode was removed entirely. Your webhook is the only credential custodian; Token Vault holds no credential in any mode.
Ready to try it?
Sign up free with Google — your credentials stay on your own webhook, and the quickstart gets an agent fetching its first credential in about ten minutes.