• Pending OAuth connection endpoints now require an API key: GET /v1/social-accounts/pending/:sessionToken and its /finalize counterpart previously accepted only the session token from the OAuth redirect, which could expose page access tokens and let a leaked link attach accounts to your org. Both now require an API key scoped to the same org as the session, and the page-picker response no longer includes access tokens. If you call these endpoints directly, make sure requests include your API key; our official SDK and demo app already do.
• Instagram messages sent outside Outstand now appear in your conversations: replies or messages sent from the Instagram app or directly through the Graph API are now ingested and stored as outbound messages, so conversation threads reflect the full exchange instead of only the messages sent through our API.
• New setup guides for Zapier, Make, and n8n: the MCP setup docs now include step-by-step connection details, including the server URL, bearer token, and correct transport setting, for each of these platforms, along with guidance on scoping and revoking API keys used with third-party tools.