What we shipped.
A running record of every release: features, improvements, fixes, and the occasional bit of infra worth flagging.
- Feature
Auth — profile pictures and self-serve username changes
End-users get first-class avatars — uploaded via the API or captured automatically from Google/GitHub sign-in — plus the ability to change their own username, all on the Consumer API.
Read more - Feature
Auth — email one-time codes as a second factor
MFA factors are no longer TOTP-only: enroll an email factor and your end-users receive a single-use 6-digit sign-in code at their verified address — with delivery through your own Mail sender domain.
Read more - Fix
Social API — deprecated aliases removed (action needed if you still use them)
The one-version deprecation windows from the June consistency pass and the conversation-route consolidation are closed: the old actor parameter names, DELETE request bodies, POST /posts/views, the conversation rename route, and the conversation-level mute/pin fields are gone. Requests using them now fail with a clear 400 or 404 instead of being accepted.
Read more - Feature
Social — video uploads
Media assets now take video: declare a clip up to 512 MB, upload it straight to storage with a presigned PUT, and get back a streaming-ready MP4 plus a poster frame — attachable to posts, comments, and DMs like any image.
Read more - Fix
Social API — one actor parameter, body-less deletes, uniform pagination (action needed)
A one-time consistency pass across the Social API: the acting actor is now `actor_id` everywhere, DELETEs take it as a query parameter, every list returns the same `{ data, pagination }` envelope, and the batch view endpoint moved to `/posts/impressions`. Old parameter names still work for one release but are deprecated — update your integration.
Read more - Fix
Social — reliable pagination, idempotent unfollows, and mutes that stick
Social list endpoints no longer skip or duplicate rows past page 1, unfollow/unmute/unblock are idempotent, muted actors are now actually excluded from the home feed, and comment visibility updates persist. Cursor tokens changed format — restart any saved pagination state from page 1.
Read more - Infrastructure
Node SDK packages renamed to match the products
The Node.js SDK packages now carry the product names: @productcraft/auth, @productcraft/mail, @productcraft/waitlist, and @productcraft/social. The old package names are deprecated on npm but keep working.
Read more - Feature
Trawl — manage jobs and webhooks from the Console
Trawl now has a home in the Console: enable it on a workspace, launch extraction jobs, watch them run, read results, and manage webhooks — no API client required.
Read more - Feature
Trawl — AI web extraction with webhook delivery
Hand Trawl a JSON Schema and a plain-English description; it browses the live web, extracts data that matches your schema, and posts the result to your webhook.
Read more - Infrastructure
New product names + API domains
The products have plain, function-descriptive names: Rally → Waitlist, Envoi → Mail, Agora → Social, Heimdall → Auth. New canonical API domains ship alongside; the old ones keep working.
Read more - Feature
Auth — Sign in with Apple
Add Sign in with Apple to any Auth app. Native iOS + macOS, web redirect flow, account linking by verified email, audit + webhook events on every signin.
Read more - Feature
Auth — tenants ship as a first-class primitive
Group your end-users into tenants ("organizations") inside any Auth app. EndUser JWTs now carry org_id + org_role, and members can switch tenants without re-authenticating.
Read more - Feature
Workspace policies — author once, bind everywhere
A new Policies surface in every workspace: name a reusable IAM-style policy, then bind it to API keys and roles. Edit the policy once and every binding picks up the change.
Read more - Feature
API keys — author full IAM-style policies from the console
Mint a Platform API Key with a multi-statement policy: allow / deny effects, action wildcards, and resource URN scoping. Fine-grained service-to-service auth, authored in the console.
Read more - Feature
Mail — query your sent message history
Every email that leaves Mail now lands in a per-workspace message log you can filter by recipient, template, status, or subject.
Read more - Feature
Mail editor — edit directly in the preview
Hover any block in the email preview for move / duplicate / delete; select text in the preview to apply bold, italic, links, headings, alignment, and color from the toolbar.
Read more - Feature
Social is now standalone — Auth integration is optional
Create Social communities without an Auth app. Bring your own user table, manage actor identity however you like, and add Auth later if you ever want it.
Read more - Feature
Social ships Phase 7-8 — notifications + Instagram-style stories
Per-actor notification inbox, story tray, highlights, close-friends visibility, and polls land in Social.
Read more - Feature
Waitlist — workspace-scoped waitlists, API-first
A new product joins the platform: Waitlist, a workspace-scoped waitlist API with reCAPTCHA, approval flows, webhooks, and analytics.
Read more - Feature
Social — Social-as-a-Service
A new product joins the platform: Social, a hosted Social-as-a-Service backend for embedding social graphs in your app.
Read more - Feature
Mail — idempotent sends and outbound webhooks
Mail adds an Idempotency-Key request header for safe retries plus signed outbound webhooks for delivery + bounce events.
Read more - Feature
Mail — per-workspace custom SMTP relays
Bring your own SMTP provider per workspace (or per domain) — Mail will relay through it instead of the platform default.
Read more - Feature
New light-theme marketing site
productcraft.co relaunched on a new light-theme design system and brand color, across every page.
Read more - Feature
One sign-in for every ProductCraft product
Platform auth is now its own first-class service. A single ProductCraft account signs you in to Auth, Mail, and every product to come.
Read more