Groups.io: Changelog

Subscribe via RSS

Area All areas Messages & Topics Editor & Drafts Hashtags Email & Delivery Members Moderation Group Settings Subgroups Integrations Calendar Files Photos Wiki Databases Chat Ask Subscription Account & Login Billing Enterprise Design & Accessibility Public Pages & Help Mobile App Site-wide

Type All types New Change Bug fix API

Search

Filter Clear

---

November 13, 2026

Account & Login

• NEW: On the Account page, the Current Password fields for changing your email address or password now offer "Forgot it? Email me a code instead." The emailed code can be entered in place of your current password for one change, and expires after 15 minutes.
• CHANGE: Changing your email address or password on the Account page, or your email address on the pages shown when your account is bouncing or needs reverifying, needed only a logged-in browser, so anyone at a computer you'd left logged in could take over your account. These changes, and Delete Password, now also ask for your current password. Accounts with no password set, such as ones that log in only with a passkey, Google or Facebook, aren't asked.
• CHANGE: "Email me a link to log in" emailed a link that logged in whichever browser opened it, so it didn't work when you read your email on a different device, in a site added to your iPhone's home screen, or when your email provider's security scanner opened the link first. It's now "Email me a login code": we email a 6-digit code to enter on the next page. The code works once, expires in 15 minutes, and only on the site where you asked for it. After 10 incorrect codes for an address in a day, codes for it are refused until the next day.
• CHANGE: Login links in emails, such as the one sent when a moderator adds you to a group directly, could be used again and again for 24 hours. They now open a page with a Log In button and stop working once you've logged in, so a security scanner opening the email no longer uses the link up.
• CHANGE: The page for entering an emailed login code had a single text field. It now shows six large boxes, one per digit. Typing moves to the next box and Backspace to the previous one, pasting a code (spaces and dashes are ignored) or having your phone fill it in from Mail fills all six, and the code is checked as soon as the last digit is entered.
• BUGFIX: The page for turning on two-factor authentication, and its help article, said you could no longer log in with an emailed login link once it was on. That wasn't the case: emailed logins still work and ask for your two-factor code as well. Only Google and Facebook logins are turned off, and the page and article now say so.
• BUGFIX: On iPhone and iPad, the Notifications settings page said notifications weren't supported in this browser. They are, once you add the site to your home screen, and the page now says so and links to instructions.
• BUGFIX: Since changing your password started asking for your current one, there was no way to set a new password if you had forgotten it: logging in with an emailed code worked, but the Account page still wanted the old password, and so did Delete Password. "Forgot your password?" on the login page now emails a code that logs you in and takes you to the Account page, where you can set a new password without the old one for the next 15 minutes. Setting it logs you out everywhere else. https://groups.io/g/GroupManagersForum/topic/122252130
• API CHANGE: /updateuser changed a user's email address or password with only an API key or a logged-in session, so anything holding the key, such as a script or an AI agent it had been given to, could take over the account. Changing email or password now also requires the user's current password in the new current_password parameter; without it, or with the wrong one, /updateuser returns bad_request with invalid current_password. Accounts with no password set can't change their email address or password through the API. Other preferences can still be changed without the password.
• API CHANGE: Login links sent by /sendloginlink now open a page with a Log In button instead of logging in straight away, and can be used only once.

November 6, 2026

Account & Login

• CHANGE: Moving between Feed, Your Groups, Topics, Hashtags, Your Calendar, Your Chats, Your Activity, Pending and Enterprise Settings reloaded the whole page each time. Now only the main part of the page changes, as it already did within a group, so these pages open faster, on the website and in the app.
• CHANGE: Email addresses at ilands.app were already banned from registering. Addresses at ilands.com and ilands.ai are now banned too, along with addresses at any subdomain of the three, such as mail.ilands.app.
• BUGFIX: Upcoming events on the Feed page were meant to show each event's color as a dot, but the dot didn't appear. It is back.
• BUGFIX: When you reached the Feed page from another page in the sidebar, the browser tab had no title. It now says Feed.
• BUGFIX: After you asked for a login link, the page saying the email had been sent was the answer to the form you submitted, so reloading it, or a phone's browser reopening that tab later, quietly asked for another link. People who left that tab open got login link emails several times a day without trying to log in. The confirmation page is now a separate page, so reloading it or reopening the tab no longer sends another email.

October 16, 2026

Account & Login

• CHANGE: Members whose login had expired landed on the groups.io home page when they went to groups.io, and had to click Log In to get to the login page. They are now taken straight to the login page, as they are when they follow a link to a group page. Members who logged out on purpose, and people who have never logged in, still see the home page, and groups.io/home always shows it. https://beta.groups.io/g/main/message/41423

October 9, 2026

Account & Login

• CHANGE: The login form, two-factor code, and passkey recovery forms now stay valid for 20 minutes instead of 4. If one does expire, it's shown again with your email address kept and a message explaining what happened, instead of a blank login page.

October 2, 2026

Account & Login

• BUGFIX: The "Your Activity" heading on your account's Activity page was always shown in English. It is now translated.
• BUGFIX: Members of a group that requires two-factor authentication, who hadn't set it up yet, couldn't add a passkey. It failed with errors such as "Failed to add passkey: The string did not match the expected pattern." Adding a passkey now works for them.
• CHANGE: A passkey now counts as two-factor authentication. Adding one satisfies a group's two-factor requirement, just like an authentication app, and the page asking you to set up two-factor now offers both options. If you have a passkey, you can turn off your authentication app even when a group requires two-factor. You can't delete your last passkey while a group requires two-factor and you have no authentication app.