LogTide
v0.6.2
Released
Breaking

Write-Only API Keys & Domain Allowlists

New write-only API key type safe for browsers and mobile, plus domain/IP allowlists with wildcard subdomain support for origin validation.

  • Write-only API keys safe for client-side use
  • Domain/IP allowlist with wildcard subdomains
  • Dogfooding SDK migration to official plugins
  • fast-xml-parser security fix

Added

  • Write-Only API Keys — New type field (write/full), safe for browsers and mobile, defaults to write
  • Domain/IP Allowlist — Up to 50 allowed origins per key with wildcard subdomain support and Origin header validation

Security

  • fast-xml-parser bumped to >=5.3.6 for entity expansion DoS fix
  • Read endpoints reject write-only API keys with 403
  • Origin allowlist validation with wildcard subdomain parsing

Breaking Changes

  • API key default type changed to write — existing keys migrated automatically, server-side queries need full type
  • Database migration 024_api_key_scopes.sql required
All releases