Changelog

Product updates, newest first. Longer write-ups live on the blog.

October 2026Copy Anchor Link

• Independent keys and agents — revoking, suspending or changing one key or agent never affects another, including ones it created. See API Keys & Scopes and the upgrade notes there.

September 2026Copy Anchor Link

• Account settings & data export — a dedicated account settings page, plus an endpoint to export your own account data.
• Bot protection on sign-in and OAuth — Cloudflare Turnstile now gates /cli/auth/begin and the MCP OAuth authorize step, cutting down on automated abuse of those flows.
• Per-service refresh pause — the scheduled-refresh circuit breaker now trips per service instead of for the whole account, so one dead token or an unreachable provider no longer pauses refresh for every other service on your vault.

August 2026Copy Anchor Link

• Docs marked manual approval unavailable — the manual_approval policy rule denies every request it's attached to (no push channel since ntfy's retirement); the docs now say so up front instead of describing a flow that can't complete.
• Agent & proxy key reveal — lost your tvagent_… or mcp_… key? Reveal on the agent or proxy detail page retrieves it again, audited like any other credential-adjacent action.
• Rate-limit hardening — floor limits per agent/proxy, an escalating penalty box for repeated bad requests, and a circuit breaker that stops hammering an unreachable webhook. See Hardening Your Webhook.
• Onboarding fixes — closed several dead ends in the first-run setup flow surfaced by dogfooding.

July 2026Copy Anchor Link

• Quickstart + docs refresh — new ten-minute quickstart fronted by the Cloudflare Workers reference webhook, honest setup estimates, and a documentation-wide accuracy pass.
• TypeScript reference webhook — the multi-runtime reference implementation (Cloudflare Workers, Cloud Run, Deno) is now the recommended production data plane: HKDF seed-derived keys, D1 storage, AES-256-GCM at rest.
• OAuth 2.1 authorization server for MCP — Claude, ChatGPT, Cursor, and any MCP client can connect with a standard in-client OAuth flow: dynamic client registration (RFC 7591), PKCE S256-only, revocation and introspection. Read the announcement · docs.

June 2026Copy Anchor Link

• tv_session proxy auth — MCP proxies can inject an auto-refreshing Token Vault session token as upstream auth, for gating your own self-hosted MCP servers with Token Vault identities and policies.
• Activity log — in-app activity feed and usage rollups, readable even when your webhook is offline (metadata only — credential events stay on your webhook).
• Webhook-sovereign only — the legacy hosted-storage mode was removed entirely. Your webhook is the only credential custodian; Token Vault holds no credential in any mode.