· 29. März 2026

Approval by push and desktop sign-in codes

An authorization request now reaches the device as a push notification, desktop clients get their own sign-in code, and a completed authorization hands the session over to the app.

Added

  • Authorization requests arrive as a push notification. When an application asks for access, the request is pushed to the device that has to approve it instead of waiting to be noticed.
  • Desktop sign-in codes. Sign-in from a desktop generates its own code, and chip expiry was extended to cover that flow.
  • Authorization continues in the app. Once authorization is granted, the session opens in the app instead of leaving the user on a finished web page.

Improved

  • Scopes written differently are still understood. Scope strings are parsed across several separators, so an application that lists its scopes with a different delimiter is no longer misread.
  • Authorization requests are scoped to the account they belong to. The list of requests is filtered by user.

Fixed

  • Session creation no longer trips over missing IP information; absent values fall back to defaults.