v26.09.10
A scoped key for every webhook
A workflow that starts from a webhook now has credentials of its own. Each workflow gets its own ingress token, so revoking one integration never touches another.
Inspect a webhook from the editor
Select the webhook trigger in the workflow editor to see everything a caller needs: the saved webhook URL, the authentication header, inputs generated from the workflow's schema, and a curl example ready to copy. Change the example inputs and the command updates without running the workflow. Because a webhook always runs the saved version, the editor points out changes you have not saved yet.
Tokens per workflow
Workspace owners and administrators create and revoke tokens for each workflow. A new secret is shown once, when it is created, and never again.
Scoped execution keys
Steps that call back into your workspace carry a short-lived key, scoped to that workspace and to the operations the run is allowed to perform. Every call re-checks the caller's membership and role, so removing someone from the workspace takes effect on their running workflows too.
Also in this release
- GPT-6 Astra is now available in the assistant's model options, at medium and high effort.

