2026-07-26 — Security, step-up, docs
Stronger step-up, safer sessions, public docs site, and KYC removed.
Confirm it’s you before sensitive changes
Profile and PIN changes now accept three ways to confirm it’s you:
- Email code — request a code, then confirm
- Authenticator app — when 2FA is on
- Passkey — options endpoint, then confirm with your passkey (does not create a new session)
How-to: Updating your profile.
Safer sessions
- Refresh tokens can only be used once. If two clients race, only one gets a new session.
- Reading your profile no longer issues a new refresh token. Refresh tokens are created when you sign in or call session refresh.
- Rate limits are shared across API replicas when Redis is configured.
Docs site
- Tabs: Guides · API · Changelog
- Home is an Introduction with who it’s for, what you get, and a short try path
- API tab uses Scalar with in-browser Try it
- Backoffice and internal routes are not published in the public OpenAPI snapshot
- Site:
https://docs.daaysorn.com(MCP at/mcp)
Removed: identity number submit
BVN/NIN submit and verify endpoints are gone. Identity verification is not part of the product surface.
Mail and Keeps
- Outbound system and mailbox mail use the platform mail provider end to end
- Keeps enrichment respects concurrency and timeout settings so jobs don’t run unbounded
Still deferred
- Production inbound mail into inboxes (listing, sending, and forwarding already work)