What's New 🤾

All new Admin UI

A rebuilt Colonel operating console — every admin capability written once, served as an op call, the CLI, and the UI.

• Write-once operations: extract Operations::* so the CLI and admin API become thin adapters over the same shared verbs
• New admin UI kit (DataTable, StatCard, FilterBar, DetailDrawer, ConfirmDialog, JsonViewer) on its own Rolldown-Vite entry, out of the customer bundle
• AdminAuditEvent: every mutating operation records actor/verb/target/result
• Support without SSH: filterable Customers list + detail page, plus Secrets, Domains, Organizations, System, BannedIPs, and Usage screens

Better branding and private-label in v0.26

A cohesive branding experience across the app, emails, and every recipient touchpoint.

• Neutral-by-default: self-hosted instances no longer ship with OTS orange or OTS branding
• BrandSettings expanded from 15 to 22 fields (product name, domain, support email, footer, logos, favicon)
• 12 email templates ported to brand helpers, replacing hardcoded colors/logos

Invites now live in EU

The invites system is now enabled in EU, completing the rollout across all five regions.

• European Union (EU)

Identity Plus users can now invite team members

UK, CA, NZ, and US have been updated; EU to be updated for Monday.

• Canada (CA)
• United Kingdom (UK)
• New Zealand (NZ)
• United States (US)

All regions unified on v0.25.2

EU, UK, CA, NZ, and US are now running the same release.

EU region upgraded to v0.25.0

EU jumped straight from v0.22.1 to v0.25.0, completing the cross-region rollout.

Organizations, SSO, and incoming secrets in v0.25

Organizations and team members, site-wide and per-domain SSO, incoming secrets, and per-domain email sender configuration.

• Organizations with role-based membership and branded invitations
• SSO authentication site-wide and per-domain (OIDC, Google, GitHub, Entra, and more IdP providers to come)
• Incoming Secrets, site-wide and per-custom-domain with recipient management UI
• Email sender configuration per custom domain with per-record DKIM verification

US region upgraded to v0.24.7

Fourth and final region in the v0.24 rollout sequence, completed in a roughly 3-hour maintenance window.

CA region upgraded to v0.24.5

Third region in the staggered v0.24 rollout, running the hardened migration pipeline.

NZ region upgraded to v0.24.3

Second region to receive v0.24, picking up V1 API and authentication fixes since the UK deployment.

UK region upgraded to v0.24.1

First region to receive v0.24, kicking off the staggered cross-region rollout.

Our API docs have a new home: api.onetimesecret.com

Canonical API documentation hub with searchable OpenAPI specs for v1 and v2, plus a per-version changelog.

UK region launched

Fifth region (uk.onetimesecret.com) launched on UpCloud, following the share-nothing regional architecture.

• Brings the total to five regions: UK, NZ, CA, US, EU
• v0.24 rollout order followed launch order: UK → NZ → CA → US → EU