API keys you can scope, and Media Center over the API

An API key can be scoped to one job

Until now, creating a key meant choosing between Full access and Read-only. Full access could rewrite every page, board, customer, and support article in the organization. Most people picked it anyway, because read-only couldn't do the work, so the median key in circulation held maximum privilege.

Custom access replaces that with a choice per feature area. Set Pages to Read, Forms to Write, leave the rest at None, and the key you hand to a form-filing workflow does that and nothing more. Operations that change permissions rather than content, like a page's visibility or a board's property schema, sit behind an Advanced toggle and never arrive with Write.

A key can also be narrowed after it's in use. When one turns out to hold more than it needs, edit its access instead of revoking it and breaking whatever depends on it. Each key has an Activity drawer now: its recent requests with time, operation, path, status, and IP address. A key you suspect has leaked can be looked at before it's killed.

Two changes sit underneath all of that. Every key carries a per-minute request limit, so a runaway script gets a 429 instead of an open door. And a route the scope registry doesn't recognize is denied rather than allowed, which closes the gap where a newly added route was callable by any key at all. The analytics dashboard and the uptime summary are readable over the API for the first time too, behind their own analytics:read scope.

Media Center over the API

The asset library is a REST resource now. List, upload, read, rename, retag, move, and delete assets. Create, read, rename, and delete folders, nested as deep as you nest them in the Hub. Every route runs through the same media feature flag and the same owner/manager/editor rules the Hub applies, so a key can't reach further than the person holding it.

Uploads come in two shapes. Anything under 20 MB goes in one call, as a public URL or a base64 payload, and it takes everything the Hub takes: images, video, audio, PDFs, Office documents, archives. Larger files use the flow the Hub uses internally. Ask for an upload URL, push the bytes to storage, then register the asset. That's the path to your organization's real ceiling, which reaches 250 MB.

Deletes are permanent here, exactly as they are in the Hub. Deleting a folder with contents still in it requires ?recursive=true, and the response tells you how many folders and assets went with it. A confirmation dialog is enough for someone clicking. A script needs the flag.

Automation emails that look like they came from you

The Send email action has a Layout field. Branded, which is the default for new nodes, builds the message out of your Brand Kit: primary logo in the header, accent color on the call-to-action button, your text split into paragraphs, an optional heading and footer note. A pale accent gets a label color you can actually read. A missing logo falls back to the organization name instead of a broken image.

You can see the result before anyone else does. The config panel renders a live preview of the same HTML the recipient will receive, produced by the same renderer the send path uses, so the preview can't drift from the real message.

Automations saved before this shipped stay on their custom HTML and text bodies and send byte-identically.

Wiring up a workflow got less fiddly

The Available variables card lists one variable per row and copies the whole {{token}} when you click it. Those paths get long, and selecting them by hand was a chore.

Webhook nodes have an Ingest URL card: the URL, a status pill for whether the endpoint is live yet, the signing secret while it's still readable, and Copy as cURL. That last one builds a ready-to-run request from the URL, the secret header, and the endpoint's most recent delivery as the body. Paste it into a terminal and you've fired your own webhook.

That delivery does more than sit in a preview now. Every addressable key in it becomes a variable suggestion, {{trigger.body.customerEmail}} and {{trigger.headers.content-type}} and nested objects alike, offered on the trigger node and everything downstream of it like any other variable.

An invitation takes you where you were invited

Opening an invitation link and signing up could land you in a fresh demo workspace instead of the organization that invited you. The link is the whole proof now. Sign in or sign up with the email it was sent to and you arrive as a member of that organization, with no second Accept click. A session whose email doesn't match the invitation never sees it. And while an invitation is waiting for you, creating a separate organization is blocked, so the invite can't be stepped around by accident.

On the organization page, every pending invitation row carries a Copy link action, and the invite you just created shows its link in a banner under the form. Useful when the invitation email is slow, or when the person would rather get it over Slack.

The support widget says what it is

Every open widget carries a line above the composer: AI assistant · May make mistakes, in all seven languages the widget speaks. "AI assistant" links to a new public AI Transparency page that explains where SharpOS uses AI, that its output needs a human read, and how the data is handled. It's written in plain language rather than as a contract.

Replies read better as they arrive, too. Words fade in as the assistant streams, with bold, code, links, and lists rendering as they land.

Under the hood

The legal pages moved under one roof. Privacy Policy, Cookie Policy, the DPA, Subprocessors, and the new AI Transparency page all sit under /terms now, and the old top-level URLs are gone. The support widget fills the screen on a phone and stays a raised panel on desktop, which had blurred together at some sizes. Page trees read a child's state from the current record instead of a stale one, and searching your active pages stays inside your organization and your visibility rules. Existing full and read-only API keys keep working against the current presets, so there's no key to reissue, and nothing here needs a migration or a new secret.