What's New 🤾

SAML SSO for self-hosted instances

Use your organization's SAML identity provider to sign in to self-hosted Onetime Secret instances and custom domains. Support for regional hosted sites is coming soon.

• Connect your self-hosted instance to a SAML identity provider with three environment variables
• Set up a separate identity provider for each custom domain in its SSO settings
• Copy the registration details you need directly from the custom domain SSO form
• Built-in checks prevent login responses from being reused and keep identities separate across providers
• Support for our EU, UK, CA, NZ and US regional sites is coming soon

Active sessions: see and revoke where you're signed in

Account security settings now list your active sessions, with per-session revoke.

• Active Sessions can be viewed from the Account Settings → Security page
• Revoke a single session or sign out everywhere
• Password and email changes still sign out all other sessions as well

Homepage forms unavailable for about three hours

Homepage forms and controls were unresponsive for about three hours after the 8 September deploy.

• The incident lasted about three hours, starting at 21:47 UTC on 8 September.
• Only the main homepage was affected; regional apps and customer data were unaffected.
• We learned deployments could use untested dependencies when build tooling fell out of sync.
• We tightened deployment safeguards and expanded browser testing to catch similar failures before release.

Interactive SSO demos

SSOWhat? provides interactive walkthroughs of OAuth, OIDC, SAML, and SCIM flows.

• Step-by-step OAuth 2.0, OpenID Connect, SAML, and SCIM walkthroughs
• User-facing screens are shown alongside the HTTP exchanges behind them

DNSSEC validation failures during our move off Cloudflare

Our DNS migration caused intermittent DNSSEC validation failures for onetimesecret.com; custom domains on onetime.co were unaffected.

• Some DNSSEC-validating resolvers could not resolve onetimesecret.com and its subdomains intermittently from about 19–26 August
• Custom domains route through onetime.co, which never used Cloudflare, and were unaffected
• Mitigation is in place: Bunny's ZSK was added to Cloudflare's DNSKEY set, stale Hetzner records were removed, and the Cloudflare zone was deleted
• Cloudflare nameserver and DS removal from the parent delegation remains pending; recovery will be verified from independent validating resolvers
• A temporary DNS probe now monitors DNSSEC validation and hostname resolution while we work on a more robust solution

Team Plans are available in all regions

Governed secret sharing for organizations: single sign-on, access controls, and workspace branding.

• Team Plans are available in every Onetime Secret region.
• Includes member and team management, plus custom sender domains.

All new Admin UI

A rebuilt Colonel operating console — every admin capability written once, served as an op call, the CLI, and the UI.

• Write-once operations: extract Operations::* so the CLI and admin API become thin adapters over the same shared verbs
• New admin UI kit (DataTable, StatCard, FilterBar, DetailDrawer, ConfirmDialog, JsonViewer) on its own Rolldown-Vite entry, out of the customer bundle
• AdminAuditEvent: every mutating operation records actor/verb/target/result
• Support without SSH: filterable Customers list + detail page, plus Secrets, Domains, Organizations, System, BannedIPs, and Usage screens

Better branding and private-label in v0.26

A cohesive branding experience across the app, emails, and every recipient touchpoint.

• Neutral-by-default: self-hosted instances no longer ship with OTS orange or OTS branding
• BrandSettings expanded from 15 to 22 fields (product name, domain, support email, footer, logos, favicon)
• 12 email templates ported to brand helpers, replacing hardcoded colors/logos

Invites now live in EU

The invites system is now enabled in EU, completing the rollout across all five regions.

• European Union (EU)

Identity Plus users can now invite team members

UK, CA, NZ, and US have been updated; EU to be updated for Monday.

• Canada (CA)
• United Kingdom (UK)
• New Zealand (NZ)
• United States (US)

All regions unified on v0.25.2

EU, UK, CA, NZ, and US are now running the same release.

EU region upgraded to v0.25.0

EU jumped straight from v0.22.1 to v0.25.0, completing the cross-region rollout.

Organizations, SSO, and incoming secrets in v0.25

Organizations and team members, site-wide and per-domain SSO, incoming secrets, and per-domain email sender configuration.

• Organizations with role-based membership and branded invitations
• SSO authentication site-wide and per-domain (OIDC, Google, GitHub, Entra, and more IdP providers to come)
• Incoming Secrets, site-wide and per-custom-domain with recipient management UI
• Email sender configuration per custom domain with per-record DKIM verification

US region upgraded to v0.24.7

Fourth and final region in the v0.24 rollout sequence, completed in a roughly 3-hour maintenance window.

CA region upgraded to v0.24.5

Third region in the staggered v0.24 rollout, running the hardened migration pipeline.

NZ region upgraded to v0.24.3

Second region to receive v0.24, picking up V1 API and authentication fixes since the UK deployment.

UK region upgraded to v0.24.1

First region to receive v0.24, kicking off the staggered cross-region rollout.

Our API docs have a new home: api.onetimesecret.com

Canonical API documentation hub with searchable OpenAPI specs for v1 and v2, plus a per-version changelog.

UK region launched

Fifth region (uk.onetimesecret.com) launched on UpCloud, following the share-nothing regional architecture.

• Brings the total to five regions: UK, NZ, CA, US, EU
• v0.24 rollout order followed launch order: UK → NZ → CA → US → EU