November 2026
App Settings and custom domains through the API and MCP. Login methods, passwords, multi-factor authentication, social logins, email, push, Live Queries, API options and the custom domain can be read and changed with an access token (scopes settings:read and settings:write) or by your AI assistant. Secrets can be set but are never shown. See App Settings and Custom domain.
Who started each deployment. Runtime › Deployments shows what started each deployment (a settings, environment variable or domain change, a build and its commit, Start Deploy) and who: you, a collaborator, a token, an AI assistant and its tool, or a push to GitHub. On/off options, numbers and Live Queries classes show before and after; values of variables and keys never do. The IP address a change came from is shown only to whoever made it. Builds say who pressed Build. Through the API: GET /apps/{appObjectId}/deployments/history.
Your app is updating. While an app you changed builds or redeploys, the dashboard says so wherever you are, and tells you when it's live or if it failed. Changes from your scripts and AI assistants show too.
App Settings errors. The App Settings pages show why a change was refused, instead of "Saved!".
Personal access tokens. Scripts, CI and AI assistants work with your apps through a token with only the scopes and apps you choose, an optional expiry, and one-click revoking: Account › Access Tokens. Tokens never get the apps' keys: calls to your data go through the API's Parse proxy, which adds the master key on our side. See Access tokens and the Management API.
Infrastructure through the API. With a token you can see what runs an app (engine, instances, high availability, version, deployments), change the engine and scaling, and switch the Parse Server version, with the same checks as the dashboard.
Activity, a real audit log. Account › Activity now shows who made each change (you, a collaborator, or a token by its name), through what (the dashboard, the API, an AI assistant and its tool), on which app, and how it ended, including refused attempts. Reads of your data are summarized by the hour; reads of your users are recorded one by one. Security events are kept for three years.
Credentials stay hidden from tokens. Access tokens see your own environment variables, never the credentials SashiDo manages, such as the database connection string.
Tokens and password changes. Changing or resetting your password revokes your access tokens, unless you mark a token to be kept.
Multi-factor authentication for your users. On Parse Server 8.6.104 and newer, turn on App Settings › Users › Allow multi-factor authentication: users add an authenticator app and log in with its code. See Users and login.
Parse Server versions in the dashboard. Runtime › Parse Server Version shows the versions you can switch to and switches your app, refusing an upgrade when a setting has to change first.
Social logins for Parse Server 8. Google needs your apps' client IDs, and GitHub, LinkedIn and Microsoft verify an authorization code with your client secret. Set them in App Settings › Users before upgrading; an upgrade without them is refused instead of breaking logins.
Server options from the dashboard. Password policy, session length and the other options in App Settings › Users are validated when you save them, as Parse Server does when it starts.
App Checks. The checks also cover social logins. App Checks sits right under Getting Started, on the Parse Server versions that run them (6.5.11 and newer); on older versions, get_app_advice through MCP runs the schema checks.
GitHub. You can disconnect and switch the GitHub account linked to your SashiDo account, and the dashboard shows repository invitations you still have to accept, with a way to renew them (Core › Cloud Code).
Flutter web. Apps on Parse Server 4.1 and newer allow the Dart SDK's headers in CORS, so Flutter web apps can talk to them.
Starter apps. React, React Native and Flutter apps with users and a private, live todo list, ready to connect to your SashiDo app.
Developer docs. These pages: from connecting your SDK to performance, limits, errors, CI/CD and the Management API.
October 2026
Email sender rules. App Settings › Emails & Hosting explains which sender addresses you can use, and the sender address is checked for domains you own.
September 2026
Two-factor authentication for the dashboard. Turn on sign-in codes by email in Account › Security, and sign out your other sessions from there.
Earlier
Android push with FCM v1 (June 2024). Upload your Firebase service account JSON in App Settings › Push: see Push notifications.