Changelog

v1.4.1 · 2026-11-01

When an app signs you out, the Tooly SSO page now offers "Sign out and use a different account", which signs you in again and takes you back to that app.
Signing out from an app now also ends your Tooly SSO session in that browser, so the next sign-in asks who you are.

Account chooser: when an app sends you to sign in, choose "Continue as" your current account or "Use a different account".
Per app setting: ask the first time in each sign-in session (default), every time, or never. Apps can also request it with prompt=select_account.

Roles are now called Groups (security access groups); apps still receive them in the groups claim.
Every app gets two groups: <client-id>-users (can use it) and <client-id>-admins (its administrators). The 1.2.0 "-admin" groups were renamed to "-admins".
Apps are locked to their own groups plus any extra groups ticked on them. Apps that used to be open to everyone kept access for people who had already signed in to them. The owners’ apps-admin group is allowed on new apps automatically.
New self sign-ups confirm their email by link before any app lets them in. Open sign-up now requires outgoing email.
Privacy Policy updated for email confirmation.

Every app now gets an automatic "<client-id>-admin" role (for example fabric-admin). People with it can always use that app, and the app receives it in the groups claim to grant admin rights.
Apps added before this version got their admin role on upgrade.
App pages show their admin role and who has it; deleting an app also removes its admin role.

Profile photos: add, change or remove a photo on your account page. Apps receive it as the standard "picture" claim.
Change your own email: a confirmation link goes to the new address, and the old address is told about the change.
Forgot your password? Get a reset link by email (your authenticator code is still required to sign in).
Admins: outgoing email settings (SMTP2GO) with a test button, email invites, and removing a person’s photo.
Privacy Policy updated: profile photos, email-change and password-reset records, and SMTP2GO as our email provider.

First release: single sign-on with OpenID Connect for self-hosted apps.
Accounts with email + password and mandatory authenticator (TOTP) two-step verification, recovery codes, lockouts and rate limits.
Roles: assign roles to people, limit each app to certain roles, and send roles to apps as the groups claim.
Admin console: users, roles, apps (OIDC clients), invite codes, analytics, security activity log with CSV export, settings.
Invite-only sign-up, with open and closed modes ready for later.
Your app list, account page with sign-in history, data export and self-service account deletion.
Light, dark and automatic themes; Privacy Policy and Terms of Service.