v0.2

Release v0.2: 2026-08-27

This release introduces Approval Groups, a named set of members and a signature threshold that governs withdrawals, policies, and group membership itself. It also adds two API security features: Client Key Pair authentication using Ed25519, and expiration dates on API keys.

Included updates:

  • Apex Platform (v0.2)
  • Fystack UI (v0.2)

New Features

Approval Groups

An approval group is a named set of workspace members plus the number of signatures required from them before a sensitive action takes effect. Assigning one to a wallet means no withdrawal leaves that wallet until enough members sign off.

Approval Group tab under User Management showing the Default Approval Group with its threshold, status, and members

Highlights:

  • New Approval Group tab under User Management, with creation restricted to the workspace Owner
  • Set a signature threshold per group, bounded by the number of members selected
  • Assign a group to a wallet so only its members can approve withdrawals from that wallet
  • Assign a group to a policy so policy and rule changes need sign-off before they apply
  • Creating a group, changing its membership, and changing a wallet's assigned group are each approval-gated, so no single person can grant themselves signing authority
  • New Approval Group Request tab under Approval for reviewing pending requests, with per-reviewer status and an optional comment on approve or reject
  • Every workspace starts with a Default Approval Group that reviews the creation of other groups

See Approval Groups for the full setup guide.

Client Key Pair Authentication

The API now supports Ed25519 client key pairs for request signing, so the credential used to sign requests never has to be stored by Fystack.

Create API Key dialog with Client Key Pair selected as the recommended authentication method, using an Ed25519 public key with no secret stored

Highlights:

  • Register an Ed25519 public key when creating an API key, and keep the private key on your side
  • Generate the key pair locally, or keep it in AWS KMS so the private key is non-exportable
  • The Create API Key flow now asks how the key should authenticate before issuing credentials

See API Keys for key generation and SDK usage.

API Key Expiration

API keys can now carry an expiration date, which makes rotation routine instead of manual.

Highlights:

  • Set an expiration date when creating an API key
  • Reduces the risk of long-lived credentials sitting unused
  • Enable IP whitelisting to restrict where an API key can be used from, available since v0.1.14
  • Set an expiration date on API keys and rotate them regularly
  • Protect private keys with hardware-backed key management such as AWS KMS
  • Give production wallets an approval group with a threshold of at least 2

Summary

Apex v0.2 is the governance and API security release:

  • Approval Groups bring multi-signature control to withdrawals, policies, and group membership, with creation and membership changes gated behind an existing group
  • Client Key Pair authentication lets an Ed25519 private key stay in your own infrastructure or in AWS KMS
  • API key expiration makes credential rotation a routine step rather than a manual cleanup