If your account has both a passkey and an authenticator app, signing in now offers the passkey first. Your browser's passkey prompt opens by itself; if you dismiss it you can try again, or choose Use a code instead to enter an authenticator or backup code.

• Passkey only: the code box asks for a backup code, and says why.
• Authenticator app only: nothing changes.
• Settings → Security: you can now rename a passkey, so you can tell your devices apart.

Also fixed: signing out after the page had been idle for a while could leave you signed in. Logout now ends the session reliably.

POST /api/auth/verify-code (and the emailed verification link) now returns a single-use setupToken, valid for 30 minutes. It proves that the person setting the password owns the email address.

Pass it to POST /api/auth/set-password together with the email and password:

{ "email": "you@example.com", "password": "<choose one>", "setupToken": "<from verify-code>" }

What you need to do. If you script or automate signup (agents, CLI-style flows), send the token from the verify step. It has been required since 2026-10-04 15:23 UTC: a set-password request without a valid token is rejected with 401. See the announcement.

Accounts that sign in with Google or through the Gluo portal cannot have a password set through this endpoint.

Documentation changed

• AI Agent Quickstart
• Local MCP Server