Account Chief now supports a dark theme across its account, team, sign-in, and public pages. Use the theme selector in the app shell to switch between light and dark mode.

When GitHub secret scanning reports a valid team API access token in a public repository, Account Chief now revokes it and emails the team’s members. Create a replacement token before reconnecting any affected integration.

Invitees who open a team invitation while signed out can now see the invitation, sign in or create an account, and return directly to accept it. Expired invitations show a clear message instead of leaving invitees at a dead end.

OAuth integrations can now register a client through the registration endpoint advertised in Account Chief’s OAuth metadata. Submit the client name, redirect URIs, grant and response types, scopes, and token authentication method to receive a client ID and, when applicable, a client secret.

The teams list now shows an Unpaid invoices count beside a team when an invoice needs action. Select the count to open that team’s invoices. Invoices with a payment already processing are excluded from the alert.

Team owners can now create and revoke team API access tokens from the Team API access tokens section of a team’s page. These tokens authenticate API requests as the team, so shared integrations and scheduled jobs do not depend on one person’s account.

When creating a personal API token for Domain Chief, you can now choose fine-grained permissions instead of full access. Select only the resources and actions an integration needs, such as reading DNS records. OAuth authorization requests also show the specific Domain Chief permissions being requested.

A pending email change now appears on your profile and the email-change page. You can cancel it before it takes effect, or submit a different address to replace the pending request. The change still requires confirmation through email.

When paying for a team plan, checkout can now offer saved payment details for reuse. You can also choose to save a payment method during checkout, making a future purchase quicker.

Open a team in Account Chief and select Invoices to see its invoices from connected Chief Tools apps in one place. The list shows each invoice’s app, date, status, and total. You can view or download the PDF once an invoice is finalized.

OAuth token responses now include a space-separated scope value showing the permissions granted to the access token. Read and store this value after a code, device, or refresh-token exchange so your integration can use the permissions the token actually has.

OpenID Connect ID tokens now include the nonce from the authorization request when you provide one. ID tokens issued with an access token also include at_hash, and hybrid responses that include an authorization code include c_hash. Your integration can validate these claims to tie the ID token to the original request and its associated credentials.

Checkout now accepts eligible promotion codes when purchasing a plan. Enter your code during checkout and review the resulting total before completing payment.

Sensitive account actions now ask you to confirm your identity before continuing. You can use the available authentication methods, including a passkey or security key, to complete the confirmation.

The team member list now shows whether each member has two-factor authentication enabled. Use the indicator to review account protection across your team.

Open Authorized applications to see the apps that have access to your account and when they were last used. Disable an app's access when you no longer use it; you can reconnect it later if needed.

Compatible OAuth clients can request a device code and ask you to approve access in your browser. This lets a command-line client connect without handling your password or hosting an OAuth callback.

When creating a personal access token, choose a team to limit the token to that team's context. Use a team-scoped token for an integration that should work with one team rather than selecting among all your teams.

The account security page now lists passkeys separately from security keys and explains how each can be used. Review your saved credentials and their usage details when managing sign-in methods.

OAuth clients can use the introspection endpoint to check whether an access or refresh token is active and inspect its associated permissions and context. Discover the endpoint through the OAuth metadata rather than hardcoding its address.