· 29. März 2026
Approval by push and desktop sign-in codes
An authorization request now reaches the device as a push notification, desktop clients get their own sign-in code, and a completed authorization hands the session over to the app.
Added
- Authorization requests arrive as a push notification. When an application asks for access, the request is pushed to the device that has to approve it instead of waiting to be noticed.
- Desktop sign-in codes. Sign-in from a desktop generates its own code, and chip expiry was extended to cover that flow.
- Authorization continues in the app. Once authorization is granted, the session opens in the app instead of leaving the user on a finished web page.
Improved
- Scopes written differently are still understood. Scope strings are parsed across several separators, so an application that lists its scopes with a different delimiter is no longer misread.
- Authorization requests are scoped to the account they belong to. The list of requests is filtered by user.
Fixed
- Session creation no longer trips over missing IP information; absent values fall back to defaults.