{ "version": "https://jsonfeed.org/version/1", "title": "Motorical: latest changes", "home_page_url": "https://docs.motorical.com/changelog", "description": "What changed in the Motorical API, dashboard and documentation.", "items": [ { "id": "https://docs.motorical.com/changelog/backup-codes", "content_html": "

One set of backup codes covers every way you sign in, whether you use a passkey, an authenticator app, or both.

\n", "url": "https://docs.motorical.com/changelog/backup-codes", "title": "Backup codes: regenerate any time, and they survive adding an authenticator", "summary": "One set of backup codes covers every way you sign in, whether you use a passkey, an authenticator app, or both.", "date_modified": "2026-10-04T11:49:00.000Z", "tags": [ "dashboard", "security" ] }, { "id": "https://docs.motorical.com/changelog/one-password-rule", "content_html": "

Every place that sets a password now applies the same rule: at least 8 characters, including a lowercase letter, an uppercase letter and a number. A symbol is welcome but does not replace a number.

\n", "url": "https://docs.motorical.com/changelog/one-password-rule", "title": "One password rule everywhere", "summary": "Every place that sets a password now applies the same rule: at least 8 characters, including a lowercase letter, an uppercase letter and a number. A symbol is welcome but does not replace a number.", "date_modified": "2026-10-04T11:48:00.000Z", "tags": [ "api", "dashboard", "authentication" ] }, { "id": "https://docs.motorical.com/changelog/passkey-first-sign-in", "content_html": "

If your account has both a passkey and an authenticator app, signing in now offers the passkey first. Your browser's passkey prompt opens by itself; if you dismiss it you can try again, or choose Use a code instead to enter an authenticator or backup code.

\n\n

Also fixed: signing out after the page had been idle for a while could leave you signed in. Logout now ends the session reliably.

", "url": "https://docs.motorical.com/changelog/passkey-first-sign-in", "title": "Sign-in: passkey first, codes as a deliberate second choice", "summary": "If your account has both a passkey and an authenticator app, signing in now offers the passkey first. Your browser's passkey prompt opens by itself; if you dismiss it you can try again, or choose Use a code instead to enter an authenticator or backup code.", "date_modified": "2026-10-04T10:58:00.000Z", "tags": [ "dashboard", "security" ] }, { "id": "https://docs.motorical.com/changelog/signup-setup-token", "content_html": "

POST /api/auth/verify-code (and the emailed verification link) now returns a single-use setupToken, valid for 30 minutes. It proves that the person setting the password owns the email address.

\n

Pass it to POST /api/auth/set-password together with the email and password:

\n
{ \"email\": \"you@example.com\", \"password\": \"<choose one>\", \"setupToken\": \"<from verify-code>\" }
\n

What you need to do. If you script or automate signup (agents, CLI-style flows), send the token from the verify step. Today a request without it still succeeds, so nothing breaks yet. We will require it after a notice period, and we will announce the date here.

\n

Accounts that sign in with Google or through the Gluo portal cannot have a password set through this endpoint.

\n\n

See Authentication and the AI agent quickstart for the updated flow. The OpenAPI document and Postman collection already include the new field.

", "url": "https://docs.motorical.com/changelog/signup-setup-token", "title": "Email signup: verify-code now returns a setupToken", "summary": "POST /api/auth/verify-code (and the emailed verification link) now returns a single-use setupToken, valid for 30 minutes. It proves that the person setting the password owns the email address.", "date_modified": "2026-10-04T10:56:00.000Z", "tags": [ "api", "authentication" ] } ] }