ChiragAgg5k · Oct 14, 2026 · Oct 14, 2026 · Oct 14, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,25 @@
 # Change Log
 
+## 30.4.0
+
+* Added: `domains` service to manage domains, DNS records, email presets, prices, transfer status and zones
+* Added: `waf` service with bypass, challenge, deny, rate-limit and redirect rules
+* Added: `account.createEmailVerificationOTP`, `updateEmailVerificationOTP`, `createRecoveryOTP` and `updateRecoveryOTP`
+* Added: `account.createIdTokenSession` and `Identity.providerIdToken`
+* Added: `oauth2.introspect`
+* Added: project environments with `project.createEnvironment`, `getEnvironment`, `listEnvironments`, `updateEnvironment` and `deleteEnvironment`
+* Added: `organization.createEphemeralProjectKey`, `listProjectKeys`, `getProjectKey`, `updateProjectKey` and `deleteProjectKey`
+* Added: Kakao, TikTok and Webflow OAuth2 providers with `project.updateOAuth2Kakao`, `updateOAuth2TikTok` and `updateOAuth2Webflow`
+* Added: optional `prompt` on the Auth0, Discord, GitHub, Microsoft, Okta, Salesforce and Zoho OAuth2 settings, and native client IDs on Apple and Google
+* Added: `project.updatePasswordPwnedPolicy`, `project.updatePasswordRotationPolicy` and `User.passwordPwned`
+* Added: `messaging.createAppwriteProvider` and `messaging.updateAppwriteProvider`
+* Added: optional `replyToEmail` and `replyToName` on email messages, `channelId` on push messages, and `qos` and `expiry` on topics
+* Added: `avatars.updatePhoto` and `avatars.deletePhoto`
+* Added: optional `duration` on `account.createEmailPasswordSession`, `current` on `account.deleteSessions`, `membershipId` on `teams.createMembership` and `fingerprints` on Android platforms
+* Added: optional `total` on the locale, transaction, runtime, specification and framework lists
+* Added: `dart-3.13` and `flutter-3.47` runtimes, the `jaspr` framework, the `trigram` index type, `auto` image gravity, the `dedicatedDatabase` proxy rule resource type, OTP email templates and new key scopes
+* Added: optional fields on `BillingPlan`, `DedicatedDatabase`, `DedicatedDatabaseSpecification`, `Project` and `Topic`, and `free` and `start` in `BillingPlanGroup`
+
 ## 30.3.1
 
 * Fixed: added `ProjectAuthMethodId::PASSKEY()`, so `project.updateAuthMethod` can enable passkeys

diff --git a/docs/account.md b/docs/account.md
@@ -541,19 +541,64 @@ Please note that in order to avoid a [Redirect Attack](https://github.com/OWASP/
 | password | string | New user password. Must be between 8 and 256 chars. |  |
 
 
+```http request
+POST https://cloud.appwrite.io/v1/account/recovery/otp
+```
+
+** Use this endpoint to send a 6-digit password recovery code to the user's email address. Unlike [createRecovery](https://appwrite.io/docs/references/cloud/client-web/account#createRecovery), this method requires no redirect URL, which makes it suitable for mobile and desktop apps that cannot host a recovery page. Learn more about how to [complete the recovery process](https://appwrite.io/docs/references/cloud/client-web/account#updateRecoveryOTP). The code sent to the user's email address is valid for 15 minutes.
+
+Enable the **phrase** parameter to include a randomly generated security phrase in both the email and the response. Showing that phrase in your app lets the user confirm the email genuinely came from your request, which helps protect against phishing.
+ **
+
+### Parameters
+
+| Field Name | Type | Description | Default |
+| --- | --- | --- | --- |
+| email | string | User email. |  |
+| phrase | boolean | Toggle for security phrase. If enabled, email will be sent with a randomly generated phrase and the phrase will also be included in the response. Confirming phrases match increases the security of your authentication flow. |  |
+
+
+```http request
+PUT https://cloud.appwrite.io/v1/account/recovery/otp
+```
+
+** Use this endpoint to complete the user password recovery process using the 6-digit code that was emailed by [createRecoveryOTP](https://appwrite.io/docs/references/cloud/client-web/account#createRecoveryOTP). Pass the **userId** of the user along with the **secret** code from the email and the new **password** to set. If confirmed, this route will return a 200 status code, the code is consumed and the user's password is updated.
+ **
+
+### Parameters
+
+| Field Name | Type | Description | Default |
+| --- | --- | --- | --- |
+| userId | string | User ID. |  |
+| secret | string | Valid recovery OTP code. |  |
+| password | string | New user password. Must be between 8 and 256 chars. |  |
+
+
 ```http request
 GET https://cloud.appwrite.io/v1/account/sessions
 ```
 
 ** Get the list of active sessions across different devices for the currently logged in user. **
 
+### Parameters
+
+| Field Name | Type | Description | Default |
+| --- | --- | --- | --- |
+| total | boolean | When set to false, the total count returned will be 0 and will not be calculated. | 1 |
+
 
 ```http request
 DELETE https://cloud.appwrite.io/v1/account/sessions
 ```
 
 ** Delete all sessions from the user account and remove any sessions cookies from the end client. **
 
+### Parameters
+
+| Field Name | Type | Description | Default |
+| --- | --- | --- | --- |
+| current | boolean | Delete the current session too. Use false to sign out of every other session while staying signed in on this one. | 1 |
+
 
 ```http request
 POST https://cloud.appwrite.io/v1/account/sessions/anonymous
@@ -576,6 +621,36 @@ A user is limited to 10 active sessions at a time by default. [Learn more about
 | --- | --- | --- | --- |
 | email | string | User email. |  |
 | password | string | User password. Must be at least 8 chars. |  |
+| duration | integer | Session length in seconds. Minimum is 60 seconds, and it cannot exceed the project maximum session length. Defaults to the project maximum session length. |  |
+
+
+```http request
+POST https://cloud.appwrite.io/v1/account/sessions/id-token
+```
+
+** Allow the user to login to their account using an OpenID Connect ID token obtained natively from the OAuth2 provider, for example via Google Credential Manager on Android or Sign in with Apple on iOS. No browser or redirect is involved: the ID token is verified against the provider's published signing keys and a session is created in a single request.
+
+Native sign-in is switched on per provider with its nativeEnabled setting. It is independent of the browser-based flow's enabled setting, which has no effect on this endpoint. The token's audience must match the provider's configured client ID or one of its native client IDs; tokens issued for any other client ID are rejected. For Sign in with Apple, register your app's bundle ID as a native client ID. For Google, the web client ID used by Credential Manager is usually the configured client ID; add your Android and iOS client IDs as native client IDs if your app requests tokens for them.
+
+Pass the raw nonce used when requesting the ID token so it can be validated against the token's nonce claim. When signing in with Apple, the nonce is required: hash it with SHA-256 before passing it to the Apple SDK, and send the raw value here - Apple tokens requested without a nonce are rejected. For Google the nonce is optional: it is validated whenever the token carries one, and ignored when the provider issued the token without one. Apple only returns the user's name on the first authorization, and never inside the ID token - capture it on the client and pass it via the name parameter.
+
+If there is already an active session, the new session will be attached to the logged-in account. If there are no active sessions, the server will attempt to look for a user with the same email address as the verified email received from the provider and attach the new session to the existing user. If no matching user is found - the server will create a new user.
+
+This flow does not return provider refresh tokens. You may pass an access token the provider handed your client, along with its lifetime, to store it on the session - but Appwrite cannot renew it once it expires. If your app needs long-lived access to provider APIs, use the browser-based OAuth2 flow instead.
+
+A user is limited to 10 active sessions at a time by default. [Learn more about session limits](https://appwrite.io/docs/authentication-security#limits).
+ **
+
+### Parameters
+
+| Field Name | Type | Description | Default |
+| --- | --- | --- | --- |
+| provider | string | OAuth2 provider that issued the ID token. Currently, supported providers are: apple, google. |  |
+| idToken | string | OpenID Connect ID token (JWT) obtained natively from the provider, for example via Google Credential Manager or Sign in with Apple. |  |
+| nonce | string | Raw nonce used when requesting the ID token. Required for Apple, and whenever the token carries a nonce claim, which must match it. Ignored when the provider issued the token without a nonce. |  |
+| accessToken | string | Provider access token to store alongside the session for calling provider APIs. Never used for authentication. |  |
+| accessTokenExpiry | integer | Seconds until the provider access token expires, as reported by the provider. Stored so clients can tell when the stored token goes stale. | 0 |
+| name | string | User name. Only used when creating a new user and the ID token has no name claim, such as on the first Sign in with Apple authorization. |  |
 
 
 ```http request
@@ -821,6 +896,37 @@ PUT https://cloud.appwrite.io/v1/account/verifications/email
 | secret | string | Valid verification token. |  |
 
 
+```http request
+POST https://cloud.appwrite.io/v1/account/verifications/email/otp
+```
+
+** Use this endpoint to send a 6-digit verification code to the currently logged in user's email address. Unlike [createEmailVerification](https://appwrite.io/docs/references/cloud/client-web/account#createEmailVerification), this method requires no redirect URL, which makes it suitable for mobile and desktop apps that cannot host a verification page. Learn more about how to [complete the verification process](https://appwrite.io/docs/references/cloud/client-web/account#updateEmailVerificationOTP). The code sent to the user's email address is valid for 15 minutes.
+
+Enable the **phrase** parameter to include a randomly generated security phrase in both the email and the response. Showing that phrase in your app lets the user confirm the email genuinely came from your request, which helps protect against phishing.
+ **
+
+### Parameters
+
+| Field Name | Type | Description | Default |
+| --- | --- | --- | --- |
+| phrase | boolean | Toggle for security phrase. If enabled, email will be sent with a randomly generated phrase and the phrase will also be included in the response. Confirming phrases match increases the security of your authentication flow. |  |
+
+
+```http request
+PUT https://cloud.appwrite.io/v1/account/verifications/email/otp
+```
+
+** Use this endpoint to complete the user email verification process using the 6-digit code that was emailed by [createEmailVerificationOTP](https://appwrite.io/docs/references/cloud/client-web/account#createEmailVerificationOTP). Pass the **userId** of the user being verified along with the **secret** code from the email. If confirmed, this route will return a 200 status code and the code is consumed.
+ **
+
+### Parameters
+
+| Field Name | Type | Description | Default |
+| --- | --- | --- | --- |
+| userId | string | User ID. |  |
+| secret | string | Valid verification OTP code. |  |
+
+
 ```http request
 POST https://cloud.appwrite.io/v1/account/verifications/phone
 ```

diff --git a/docs/avatars.md b/docs/avatars.md
@@ -134,6 +134,26 @@ Passing `userId` — `current()` for the authenticated user — resolves the pho
 | name | string | Name to render initials from instead of the user's own name. Max length: 128 chars. |  |
 
 
+```http request
+PUT https://cloud.appwrite.io/v1/avatars/photo
+```
+
+** Update the profile photo of the currently authenticated user. The uploaded image takes priority over every other photo source, including OAuth2 identity photos, Gravatar, and Libravatar. Updating an already customized photo replaces it. The image must be at most 5MB and is sent in a single request. **
+
+### Parameters
+
+| Field Name | Type | Description | Default |
+| --- | --- | --- | --- |
+| file | file | Binary image file of at most 5MB. Allowed file types are png, jpg, jpeg, and webp. |  |
+
+
+```http request
+DELETE https://cloud.appwrite.io/v1/avatars/photo
+```
+
+** Delete the profile photo of the currently authenticated user and store the built-in static placeholder in its place. The placeholder is the user's photo from then on, so it takes priority over every other photo source — OAuth2 identity photos, Gravatar, Libravatar, and initials — until a new photo is uploaded with avatars.updatePhoto. **
+
+
 ```http request
 GET https://cloud.appwrite.io/v1/avatars/qr
 ```

diff --git a/docs/databases.md b/docs/databases.md
@@ -43,6 +43,7 @@ GET https://cloud.appwrite.io/v1/databases/transactions
 | Field Name | Type | Description | Default |
 | --- | --- | --- | --- |
 | queries | array | Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/queries). | [] |
+| total | boolean | When set to false, the total count returned will be 0 and will not be calculated. | 1 |
 
 
 ```http request

diff --git a/docs/documentsdb.md b/docs/documentsdb.md
@@ -52,6 +52,7 @@ GET https://cloud.appwrite.io/v1/documentsdb/transactions
 | Field Name | Type | Description | Default |
 | --- | --- | --- | --- |
 | queries | array | Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/queries). | [] |
+| total | boolean | When set to false, the total count returned will be 0 and will not be calculated. | 1 |
 
 
 ```http request