https://docs.motorical.com/changelog Motorical: latest changes 2026-10-04T11:49:00.000Z https://github.com/jpmonette/feed What changed in the Motorical API, dashboard and documentation. https://docs.motorical.com/img/motorical-app-icon.svg Copyright © 2026 Motorical. <![CDATA[Backup codes: regenerate any time, and they survive adding an authenticator]]> https://docs.motorical.com/changelog/backup-codes 2026-10-04T11:49:00.000Z One set of backup codes covers every way you sign in, whether you use a passkey, an authenticator app, or both.

  • Regenerate backup codes is now available in Settings → Security, including for accounts that only use a passkey. Replacing the set invalidates the old codes immediately and needs a fresh confirmation from you.
  • Adding an authenticator app no longer replaces your codes. If your account already has backup codes, they stay valid and the setup screen says so. Before this change, enabling an authenticator app generated a new set and silently invalidated the one you had saved.
]]> <![CDATA[One password rule everywhere]]> https://docs.motorical.com/changelog/one-password-rule 2026-10-04T11:48:00.000Z Every place that sets a password now applies the same rule: at least 8 characters, including a lowercase letter, an uppercase letter and a number. A symbol is welcome but does not replace a number.

  • The sign-up, set-password, reset-password and change-password forms all check the rule before you submit, so a password the server would refuse can no longer look acceptable.
  • The API returns a single message for every violation: "Password must be at least 8 characters and include a lowercase letter, an uppercase letter and a number".
  • If setting the password fails after your verification code was accepted, you can retry without requesting a new code.
  • The sign-up password form now includes your email as the username, so your browser's save-password prompt stores a complete login.
]]> <![CDATA[Sign-in: passkey first, codes as a deliberate second choice]]> https://docs.motorical.com/changelog/passkey-first-sign-in 2026-10-04T10:58:00.000Z If your account has both a passkey and an authenticator app, signing in now offers the passkey first. Your browser's passkey prompt opens by itself; if you dismiss it you can try again, or choose Use a code instead to enter an authenticator or backup code.

  • Passkey only: the code box asks for a backup code, and says why.
  • Authenticator app only: nothing changes.
  • Settings → Security: you can now rename a passkey, so you can tell your devices apart.

Also fixed: signing out after the page had been idle for a while could leave you signed in. Logout now ends the session reliably.

]]> <![CDATA[Email signup: verify-code now returns a setupToken]]> https://docs.motorical.com/changelog/signup-setup-token 2026-10-04T10:56:00.000Z POST /api/auth/verify-code (and the emailed verification link) now returns a single-use setupToken, valid for 30 minutes. It proves that the person setting the password owns the email address.

Pass it to POST /api/auth/set-password together with the email and password:

{ "email": "you@example.com", "password": "<choose one>", "setupToken": "<from verify-code>" }

What you need to do. If you script or automate signup (agents, CLI-style flows), send the token from the verify step. Today a request without it still succeeds, so nothing breaks yet. We will require it after a notice period, and we will announce the date here.

Accounts that sign in with Google or through the Gluo portal cannot have a password set through this endpoint.

See Authentication and the AI agent quickstart for the updated flow. The OpenAPI document and Postman collection already include the new field.

]]>