OAuth 2.1
- Dynamic client registration and PKCE, with bearer tokens still accepted for clients that prefer a header.
No quarters, no promises with dates attached. This is the order things are being worked on, and the reasoning behind it — including the things that are deliberately not on the list.
Done: /connect runs the QR flow, and OAuth means a client can send you there and collect its own credentials. Next for it: revoking and rotating without writing to us.
Each account needs a supervised sync process with health checks and a visible “your session expired, rescan” signal. Right now a dropped session is only visible in account_status.
MIT, with the deployment scripts and a reproducible build. Claiming to be open source while the source sits on one laptop is a claim with an expiry date.
Bulk messaging or campaign tools. That is what gets numbers banned, and it is not the product.
Reading accounts you do not own. No monitoring features, no “link your employee's phone” flow.
A hosted model. The gateway hands messages to your client. It does not run inference, and it does not want your content in a prompt we control.
Analytics on message content. Not for product metrics, not for “insights”, not as an upsell.
Actual use. If the people trying this keep hitting the same wall, that wall moves to the top — and the change shows up in the changelog with a date. If you want something on this list, say so: [email protected].