Changelog

New Features

• JWT Tokens — Obtain access tokens via /auth/token endpoint
• Token Refresh — Refresh expired tokens without re-authentication
• Token Revocation — Revoke individual tokens or all active sessions
• Session Management — View and manage active sessions from the dashboard
• Token Info — Inspect token claims and expiration

Security

• Short-lived access tokens with refresh token rotation
• Secure token storage with hashed refresh tokens

New API Endpoints

• GET /client/v2/emails/receiving/{id} — Get inbound email detail
• DELETE /client/v2/emails/receiving/{id} — Delete a received email
• POST /client/v2/emails/receiving/{id}/reply — Reply to a received email
• POST /client/v2/emails/receiving/{id}/forward — Forward a received email
• GET /client/v2/emails/{id} — Get outbound email detail
• DELETE /client/v2/emails/{id} — Delete a sent email
• Attachment APIs — List, download, and delete attachments on received emails

Improvements

• API documentation updated with all new endpoints
• Improved error responses with consistent JSON format

Security

• Domain-based email restrictions for API keys
• Allowed domains whitelist enforced on send operations

New Features

• Email Monitor — Admin dashboard to review outbound email activity
• Campaign Review — Approve or reject campaigns before they are sent
• Review Queue — Pending review count badge in navigation
• Alert Management — Mark monitoring alerts as read
• Monitor Config — Configure monitoring thresholds and rules

Security

• Admin endpoints protected with key-based authentication
• Campaign preview available for reviewers before approval

New Features

• Forgot Password — Request a password reset link from the login page
• Secure Reset Token — Time-limited token sent via email
• Reset Confirmation — Success page after password is updated

Improvements

• Login page now shows "Forgot password?" link
• Modal-based forgot password form with loading states and error feedback
• Auto-close modal after successful submission

New Features

• API Keys — Generate API keys from Settings > Keys
• Scope-based Permissions — Configure granular scopes (send, receive, contacts, etc.)
• IP Whitelisting — Restrict API key usage to specific IP addresses
• Key Expiration — Set optional expiration dates for API keys
• Bearer Token Auth — Standard Authorization: Bearer sk_live_xxx authentication

API Endpoints

• POST /client/v2/emails — Send emails
• GET /client/v2/emails — List sent emails
• GET /client/v2/emails/receiving — List received emails
• GET /client/v2/verify — Verify API key validity

Security

• API keys are hashed with SHA-256 before storage
• Last used timestamp and IP tracked for audit