Magic links, organization API keys, and guided setup

A new user can now get from clone to a configured app with one command, and your users get two new ways to reach the product: a passwordless sign-in link, and API keys for their organization.

Magic-link sign-in

The login page can send a one-time sign-in link. Tokens are stored hashed and expire after 15 minutes. The link goes through the same email path, language, and abuse limits as the other auth emails, and it is captcha-gated when Turnstile is on. An unknown address creates a verified account with its own personal organization. Accounts with two-factor auth still have to pass the existing verify page. Password and OAuth sign-in are unchanged.

Organization API keys

Owners and admins issue keys from organization settings. The secret is shown once and stored as a SHA-256 hash. Scopes are read-only: organization:read, member:read, invitation:read, billing:view, and audit:view. A key authenticates with Authorization: Bearer, and unknown, expired, and revoked keys all get the same unauthorized answer. Issuing, rotating, and revoking are written to the organization audit log. Chat, checkout, member changes, and support still require a signed-in session, so a leaked key can read but not act.

pnpm setup:init

pnpm setup:init is the interactive first-run command. It asks for a billing provider (Stripe, Polar, or Creem), an email provider (Plunk, Resend, Postmark, Brevo, SendGrid, or SMTP), and each optional feature. You can paste keys now or add them later. It merges apps/web/.env rather than overwriting it, so comments and keys you did not touch stay. Afterwards it runs pnpm setup:doctor and offers Docker Postgres, migrations, and the demo seed. It never runs db:reset.