Apps that support it, such as AI clients connecting through MCP, now offer All my teams when you authorize them. Choosing it grants access to every team you belong to, including teams you join later, so you don't need a separate connection for each team. The app still gets only the permissions you approve.

Team Owners can choose All apps, Specific apps, or No apps when inviting a Member, and edit an existing Member's app access from Teams. Specific apps keeps newly added apps off limits until you grant access.

The team invoices API can filter invoices by app with app_id, sort them by invoice date with sort=asc or sort=desc, and include invoice lines with expand[]=lines. When an app supplies resource details, each line also identifies the billed resource by ID, type, and label.

If you lose access to your authenticator app, passkey, or security key, you can use a recovery code to complete sign-in. Open Two-factor and Passkeys from the Account menu, then select Generate recovery codes while you still have access to a second factor.

OAuth clients can use private_key_jwt to authenticate with a signed client assertion instead of a shared secret. Host the public keys at a jwks_uri, then send a short-lived assertion when calling the token, revocation, or introspection endpoint.

An OAuth client can use the HTTPS URL of its Client ID Metadata Document as its client ID. Account Chief reads the document for the app name, redirect URIs, and authentication settings, allowing compatible clients to connect without a separately issued client ID.

Desktop and command-line OAuth clients can use a local HTTP callback on localhost, 127.0.0.1, or [::1]. Register the client as a native application; the callback port can vary during authorization, so the app can use an available local port.

OAuth clients can send a resource URI during authorization or device authorization to request a token for a specific API. Account Chief carries that audience through token exchange and refresh, and rejects a token request for a different resource.

Team Owners can choose a role when inviting someone and change another member's role from Teams. Owner manages the team, Member uses connected apps, and Billing manages subscriptions and invoices without app access.

Integrations can now update team settings and manage membership through the Account Chief REST API. Invite or remove people, change a member's role, and list team access token metadata without exposing token values.

When creating a personal or team API token, you can choose Fine-grained permissions for apps that support them and select only the operations the token needs. Full access remains available when appropriate.

The Account Chief REST API now lets integrations list a team's connected apps, plans, and limits, and retrieve its invoices. Request invoice lines when you need a detailed billing report.

Invoices with detailed charges now have a Details link. Open it to review line items grouped by team and category, including each item's service period, amount, and category subtotal.

Teams linked for unified billing share one billing team for subscriptions and invoices. In Teams, a linked team shows which billing team manages its charges, and the billing team lists its linked teams.

You can approve an OAuth app without giving it every Chief Tools product permission it requested. On the authorization screen, clear the optional permissions you do not want to share, then continue with the remaining access. This also works for device authorization when the client supports partial grants.

When a SEPA direct debit starts processing for a team invoice, Account Chief emails the invoice to the customer email address recorded for it. The message includes the invoice PDF and, when available, a link to view it online.

When you open a connected app from Account Chief while viewing a team, the app switcher now carries that team into apps with team-specific links. This lets you move between tools in the team you are working with.

OpenID Connect integrations can now use the UserInfo endpoint advertised in OpenID discovery to retrieve the signed-in user's subject and permitted profile, email, and team claims. The endpoint accepts either GET or POST with an OAuth access token that has openid.

OAuth clients can now request response_mode=fragment or response_mode=form_post during authorization. The form_post mode sends the authorization result to the client's redirect URI in a browser POST, while fragment places it in the URL fragment.

Use the command menu to search your teams by name or slug and open a team directly. It also offers shortcuts to common Account Chief pages and the app switcher.