The CLI now signs in at console.getghosty.dev.ghosty login (0.19.0) opens the console at its own address, console.getghosty.dev, instead of going through getghosty.dev. Nothing to do if you're on an older version: existing installs keep working — sign-in requests to the old address are forwarded automatically, so there's no forced upgrade. The GHOSTY_CONSOLE_URL override is unchanged.
This release also includes reliability improvements to the Ghosty platform behind the scenes. See signing in for the updated sign-in details.
Sign-in links that survive strict email security
One-time sign-in links now hold until you click "Finish signing in", GitHub connections bind to the right account, and account removal retries got sturdier.
Sign-in links now survive company email security
Many company mailboxes run security tools that open every link in every
email the moment it arrives. Ghosty's sign-in links work exactly once — so
those tools were using them up before anyone could click, leaving some
people (especially on corporate email) stuck at "this link was already
used". Sign-in links now land on a small Finish signing in page, and
the link isn't spent until you press the button. Scanners can look all
they want; your link waits for you. This applies everywhere you sign in
with email — the console and the command line. docs →
GitHub connections bind to the right account
On personal workspaces, connecting GitHub could silently latch onto a
GitHub organization instead of your personal account, which later broke
app creation in ways that were hard to trace. The connect flow now guides
you to install on your personal account and clearly rejects a mismatched
choice, so what you connect is what your apps use.
Sturdier account removal
Retrying a failed account removal now converges in a single click —
previously each retry could advance only one step at a time. Removals are
also reported more precisely along the way.
Stay signed in longer, and full account removal
Sessions now last 7 days and renew while you're active, expired sessions send you back to sign-in gracefully, and accounts can now be removed completely on request.
Sessions that keep up with you
Signing in now lasts 7 days instead of 24 hours, and staying active keeps your session fresh — daily users effectively never get signed out mid-work. When a session does expire, you no longer hit a confusing error: the console now takes you straight back to the sign-in page, and once you're signed in again it returns you to the exact page you were on.
Full account removal
We can now remove an account from the Ghosty platform completely on request: every app is taken down, custom domains are released, and all sign-in access and stored account data are purged. Removal is cleanup, not a ban — the same email is free to sign up again afterward. If you'd like an account removed, contact us.
Smarter custom domains and steadier app setup
Point www at your app in one click, get told exactly which DNS record is missing, and app creation now rides out temporary hiccups on its own.
Your www visitors, covered
Most people type www. in front of a domain — but if only the bare
domain is connected to your app, those visitors hit a dead end. Now,
when you connect a domain like yourdomain.com to an app, Ghosty
offers to connect www.yourdomain.com at the same time with a
pre-checked option. One click, both addresses. The www connection is
independent, so you can remove or repoint it separately at any time.
docs →
"Still connecting…" now tells you why
Waiting on a domain that never comes online usually means one thing:
a DNS record that was never created. The domain page now tells the
difference between a record that exists but hasn't taken effect yet
and one that's missing entirely — and when it's missing, it shows the
exact record to add at your domain provider, so you can fix it in one
visit instead of guessing. docs →
App creation shrugs off temporary hiccups
Very occasionally, a brand-new app could show a red failure during
setup even though nothing was really wrong — a piece of the platform
was simply asked for before it had finished getting ready. Setup now
detects that situation and quietly retries until it clears, so those
false alarms are gone. And on the rare occasion something genuinely
does fail, the message you see is now written in plain language and
tells you what to do next — while the details reach our team
automatically so we're already looking into it.
Start working on your new app faster
The create wizard no longer makes you wait for the first launch — you get everything you need to start building right away.
Creating an app used to end with a wait: the wizard held you on the
progress screen while the first version built and launched — usually a
couple of minutes — before showing you the handoff prompt and links.
That wait is gone.
Setup completes as soon as there's something to work on. The moment
your app's code and workspace are ready, you get the handoff prompt,
the repository link, and everything you need to start building — the
first version finishes launching in the background, and the page flips
to your app's live address on its own.
The app page keeps you in the loop. While the first version is
launching, your app's page shows exactly that. And if a first launch
ever fails, the page says so and gives you a working Try again
button that picks up where things left off — no more new apps stuck
saying "needs attention" after a rough start.
Your apps can now receive events — plus a rounder, more reliable platform
Stripe and other services can push verified events straight to your app, the Ghosty command line keeps itself up to date, and domain setup got friendlier.
The biggest piece first: connected services don't just answer your app
anymore — they can notify it. Enable events for an attached service
(Stripe, for example) and Ghosty gives you an events address to paste into
that service's dashboard. From then on, every notification is checked for
authenticity and delivered to your app's code — a checkout completing, a
subscription changing — with unverifiable deliveries dropped before they
ever reach you, and a Recent-events list so you can see what arrived.
Scaffolded apps include a ready-made handler: register what you care about
and the platform does the rest.
The Ghosty command line now keeps itself current. It quietly checks for
newer versions, tells your app's coding assistant in a way it can act on
(so updates just happen — you're never asked to run anything), and the
platform can gently retire versions that are too old to serve safely.
Custom domains got sturdier: a domain's verification window is now
visible while it's counting down, a domain that verifies near the deadline
is honored rather than dropped, and if one does expire you can reclaim it
yourself immediately — no support round-trip.
And a fix worth celebrating: new apps no longer show a failed first
deploy in their history. One deploy, the right one, from the first
minute.
Invite your team, and apps only your workspace can use
Company workspaces now run on invitations instead of email domains — and apps can require a workspace sign-in from everyone who uses them.
Setting up a company on Ghosty no longer asks who's allowed to sign in.
Create your workspace, then invite people from the Team page: add a
teammate's email and they can sign in right away — any address, work or
personal — and they get a note letting them know. Remove someone and their
access ends immediately. No domain lists to maintain, no one locked out of
their own workspace.
Apps gain a matching superpower: a new "Workspace members" access mode.
Pick it when creating an app and every visitor must sign in as a member of
your workspace — a branded sign-in with their email, nothing to configure
in your code. Removing someone from the team closes their app access too,
and a "Sign everyone out" button in the app's settings resets all sessions
at once. The existing public, invite-link, and build-your-own modes are
unchanged.
Also new in the catalog: Melonn — connect the Sellers API once and your
apps can manage orders, products, stock and returns without handling
credentials.
Browse your app's files, and seven more services to connect
A new Files tab shows everything your app has stored — plus Algolia, Pinecone, Firecrawl, Exa, Mapbox, Postmark and Telegram join the catalog.
Apps that store files no longer keep them out of sight. Every app page now
has a Files tab: browse folders, preview images, PDFs and text right in
the console, download anything, and delete what shouldn't be there. Files
stay private to the app — viewing and downloading happen through your
signed-in console session only, never through public links.
The integrations catalog also grows from 18 to 25 services. New this
release: Algolia and Pinecone for search, Firecrawl and
Exa for AI agents that read the web, Mapbox for maps, Postmark
for email, and Telegram for bots. Same model as always — connect once,
attach to any app, and the credential never appears in your code.
A live usage view for every integration, plus built-in fair-use protection — no setup required.
Every app's Integrations tab now shows what it's actually doing with the
services you've connected: how many calls it made to each one over the last
7 or 30 days, how fast they were, and whether any failed. No agents to
install, no dashboards to configure — if your app talks to OpenAI, Stripe,
or any other connected service, the numbers are already there.
Alongside the visibility, the Ghosty platform now applies sensible fair-use
limits per app and service, so one runaway loop can't exhaust a shared
account or your provider bill. Apps that hit a limit get a clear signal and
can simply retry a moment later; everything else keeps flowing untouched.
This release also lays groundwork you'll see surface soon: the platform can
now look inside an app's file storage, powering an upcoming Files view of
everything your app has stored.
Eighteen integrations — AI models, payments, email, messaging and more — with one connection, zero keys in your code.
Your Ghosty apps can now talk to the outside world without you ever handling
a credential in code. Connect a service once from the console — OpenAI,
Anthropic, Stripe, Resend, Twilio, Slack, GitHub, Notion and ten more —
and attach it to any of your apps with a click.
The key you paste is encrypted immediately and never shown again, not even
to you. Your app calls the service through the Ghosty platform, which adds
the real credential on the way out — so nothing secret ever lives in your
repository, your environment files, or your deploys. Detach or rotate at
any time and access stops on the next call, no redeploy needed.
On company plans, a connection can be shared with the whole team: one
Stripe account, every app on it, revocable by whoever created it.