Signup Links, Custom Domains, and Per-Person Plans

Release Notes

Identity gains signup links: invite someone with a link that already carries their roles, and they join in one click, through Blocks OIDC or from inside your own app. Custom domains now come with a guided setup that shows each step as it runs. Data Gateway adds an Enum field type. Subscriptions can be sold per person, with each person getting their own allowance. The CLI now covers proxies, schedules, custom domains, and GitHub connection.

Identity

• Signup links — Under Identity & Access → One-Click Signup, you create a configuration that holds the defaults for one kind of invitation: roles, permissions, how long a link lasts, where the person lands afterwards, and whether they set a password (PasswordRequired) or join without one (Passwordless). Each link you then generate is tied to one email address, and its grant is fixed when it's made. A link is stored only as a hash and can be revoked one at a time or for a whole configuration. Generating a link checks that you're allowed to assign the roles it grants, so a link can't hand out more access than you have.

• Two modes — Blocks OIDC mode sends the person through your registered OIDC client and back to its registered redirect URI. IAM checks that redirect when the link is generated and again when it's used. Embedded mode is for apps that run with OIDC off. Your app shows its own join screen, calls signup-links/context and signup-links/redeem, and gets the tokens back directly. IAM never redirects in this mode, because there's no registered client to check a redirect against. The configuration form shows only the fields that apply to the mode you choose, and the client is picked from a list instead of typed in.

• Signed in on arrival — Previously, someone who accepted a PasswordRequired invitation set a password and was then asked to type it again on the sign-in page. Turn on Sign in after activation and they arrive already signed in. This works in both modes. The setting is on by default for new PasswordRequired configurations. Existing configurations are unchanged.

• Multi-use links — A link can now be used more than once. Set maxRedemptions to a number, or to 0 for unlimited uses until the link expires. Leave it out and the link stays single-use, as before.

• Link activity — POST iam/signup-links/summary returns, for each configuration, how many links were generated, used, never used, and rejected. It returns counts only, no link ids or email addresses.

• Account state on the users list — Previously an invited, deactivated, or suspended user all showed as "Inactive". Each user now has one accountState (Active, PendingVerification, Suspended, or Deactivated), and the portal's users list has a Status column and filter. In the API, the accountStates filter also accepts LockedOut. Bulk role changes use the same filter. The existing active and status fields are unchanged.

• Rotate client secrets — POST client-credentials/{id}/rotate-secret issues a new secret for a client credential and returns it once. Saving a client credential returns the secret only when the credential is first created. An update keeps the existing secret.

• Client status in the list — The OIDC client list now shows an Active/Inactive badge and lets you enable or disable a client from the row, as the client credentials list already does.

• Revoke default-organization access — In multi-organization tenants, you can now remove a user's access to the default organization from their Access tab. You still can't remove your own access.

• Delegated access for services — A delegated-access grant can now name an OAuth client instead of a user. When it's redeemed, IAM issues a client_credentials token (with no refresh token) and checks that the client is still active. This is the server side of the Genesis (.NET) v4.2.3 change in the September 27 notes.

• No more repeat activation emails — Revoking access, reinstating a user, or activating a social-login account used to send the user a new activation email, which looked like being invited again. Activation emails now go out only when a user is created.

• Security fixes — If an OIDC redirect_uri doesn't match a registered client, IAM now shows its own login error page instead of redirecting to the supplied URL. The user-exists check (users/exists) now takes the email in a POST body instead of the query string. A GET on email/available returns 405. This keeps email addresses out of URLs and logs. If you call users/exists directly, switch to POST.

OS

• Guided custom domains — Previously, adding a custom domain didn't tell you which DNS records to create or which API address to use afterwards. Setup now lists the exact records: a CNAME for a subdomain, or an A record with the target's IP for a root domain. It then shows verification, server configuration, and certificate issuance as they happen. Setup keeps running if you close the tab, and only one setup can run per domain at a time. The domains table shows each domain's API base URL. The connect step's Test now link opens your domain's IAM Swagger page, which loads only when the domain, its certificate, and the gateway route all work.

• Archived and purged secrets — Secrets now have an Archived view with its own count. An archived secret stops working until you Restore it, or you can Purge it to delete it permanently, including from Azure Key Vault.

• Connect with Blocks OS — An external site, such as a CMS, can send you to Blocks OS to connect it to a project. You sign in and pick a project and environment, or create a project on the spot, then approve the connection. The page waits until the environment is ready. If you have to sign in partway through, the request picks up where it left off. Connections are managed under Integrations (previously Connect).

• Links survive sign-in — If you open a portal link while signed out, you're taken back to that page after signing in.

• Project limit — You can own up to 10 projects. The server now enforces this limit, not only the console. A project's environments (dev, stg, prod) count once, and projects shared with you don't count. Adding an environment to an existing project is never blocked.

Data

• Enum fields — Schemas get an Enum property type. You list the allowed values in the schema editor: up to 100, each 1–100 characters of letters, numbers, and underscores, not starting with a number, and no duplicates. Each Enum field becomes its own GraphQL enum type, so a value outside the list is rejected and clients can discover the allowed values from the schema. Enum fields can be filtered with eq, neq, in, and nin.

• No more blank Data Gateway screen — Data Gateway could open to an empty main area when the project configuration loaded before the session. It now waits and shows a loading or error state instead.

Workflow

• Reliable branching — When an If node splits items, only the branches that actually received items continue. A node that joins several branches now waits until every parent has either finished or can no longer run, so it runs once with all its inputs instead of early or twice.

• Correct webhook responses — A webhook-triggered workflow now responds with the result of the last node that actually ran, following only the branches that received items. Previously it could pick a node on a branch that never ran.

• Steadier parallel runs — When parallel nodes finish, each completion and the nodes it starts are recorded as one step, so a run can't skip a node or run one twice.

• Execution history — The executions list and execution view were reworked, and the Transform Code node guide now has sections and worked examples.

Utilities

• Per-person plans — A plan can now be sold to each person in an organization, not only to the organization as a whole. The organization buys places, and an administrator assigns each place to one person. Each place has its own allowance (for example, 100,000 AI tokens per month), and only the person holding it can use it. Overage is calculated place by place. When a person uses something, their place pays first, and anything it doesn't cover falls back to the organization's plan, so an organization can have both kinds of plan at once. A place keeps its usage when it's reassigned. People can see their own subscription with GET /subscriptions/mine. A service calling with client credentials can name the user whose place should be charged. See the per-person plans guide in the Subscription API documentation.

• Flexible rate limits — A rate limit on a meter (for example, "at most 1,000 an hour") can now span several windows and be measured as a rolling window, and one meter can have several limits at once. The plan builder names the window each limit applies to, and warns you when a limit can never be reached because the plan's included amount is lower.

• Better invoices — Invoices list discounts as their own lines, show a customer number and the masked card, and follow the standard financial-document layout. Financial-document PDFs are stored with organization-level access. Adyen subscription checkout now always saves the card.

• PDF signature validation — A new asynchronous API checks the digital signatures of PDFs already in Blocks storage using the European Commission's DSS library. Send file ids to POST /pdf-signature-validations (202 Accepted), then read results with POST /pdf-signature-validations/status. You get a verdict per file and per signature, including the PAdES level reached. Trust comes from the EU List of Trusted Lists plus any extra trust anchors you configure. Only the revocation data embedded in the document is used. Files are never modified. A completion notification can be sent for each file.

• Templates with nested data — The template engine now renders nested JSON objects and lists in template data.

Studio

• A better model picker — The chat model picker is a fixed-height popover with Blocks provided and Your models tabs, search by model or provider, and grouping by provider. It now lists every chat model in the catalogue. Embedding models are left out because they can't chat.

• Requests go to the right place — Studio now decides by what you mean, not by keywords, whether a message describes a new requirement (which becomes a feature) or asks for a build.

• Fixes — Features can be edited again. Telegram file paths resolve correctly. The PRD document structure has been reworked.

Extension

The UILM Assistant browser extension (v1.2.0) can now create keys and publish from the side panel:

• Add new keys — Create a localization key and its translations directly from the page you're working on.

• Publish changes — Publish your localization changes from the side panel instead of switching to the portal.

• Smoother sign-in — Fixed tokens expiring too early and the screen flickering during the Blocks sign-in flow, plus smaller UI fixes.