v0.1.14

Release v0.1.14: 2026-05-31

This release adds license key enforcement for self-hosted deployments, real-time notifications delivered over Server-Sent Events, API key IP whitelisting, and the first wave of role-based access control ahead of the full RBAC rollout in v0.1.15.

Included updates:

  • Apex Platform (v0.1.14)
  • Fystack UI (v0.1.14)

New Features

License Key System

Self-hosted deployments are now gated by a signed license key, so an installation can be verified as licensed before it runs.

Highlights:

  • Deployments are gated by a signed license key, verified against a public key
  • New keygen CLI for issuing keys

Real-Time Notifications

Notifications now stream to clients over Server-Sent Events instead of being polled, so alerts and status updates arrive instantly.

Highlights:

  • Delivery moved from polling to Server-Sent Events
  • Instant delivery of alerts and status updates

API Key IP Whitelisting

API keys can now be restricted to a whitelist of client IP addresses, which limits what an attacker can do with a leaked key.

Highlights:

  • Restrict an API key to a whitelist of client IP addresses
  • Whitelists can be updated after the key is created
  • Reduces the blast radius of a leaked key

RBAC Foundations

The first stage of role-based access control, laying the groundwork for the full overhaul in v0.1.15.

Highlights:

  • Roles are assigned on workspace invitation
  • Roles are surfaced in workspace API responses
  • New audit trail records role changes

Fixes

Canonical JSON Signing

Fixed JSON canonicalization to follow RFC 8785, addressing a pentest finding. This affects anything hashed or signed against a canonical payload.

Summary

Apex v0.1.14 is the licensing and access foundations release:

  • License key system gates self-hosted deployments behind a signed, verifiable key
  • Real-time notifications replace polling with Server-Sent Events
  • API key IP whitelisting limits the damage a leaked key can do
  • RBAC foundations introduce roles on invitation, in API responses, and in a new audit trail
  • RFC 8785 canonicalization closes a pentest finding affecting signed payloads