Changelog

All changelog posts

• Jul 13, 2026

  Subscriber Credentials Drawer

  Manage every subscriber's delivery credentials from one drawer in the dashboard.

  Author:

  Paweł Tymczuk

  • Dashboard
  • New Feature

  

  You can now view and manage all of a subscriber's delivery credentials right from the dashboard. Open any subscriber, switch to the new Credentials tab, and every channel they can be reached on is in one place — no more round-trips to the API to check why a push or chat message didn't land.

  

  Grouped by channel

  Credentials are organized by channel — Email, SMS, Push and Chat — with a card per connected integration. Push lists each device token, Chat shows webhooks and endpoints for Slack, Microsoft Teams, Telegram, WhatsApp and more. Values are masked by default, with a toggle to reveal them and one-click copy.

  Add and edit credentials inline

  Add credentials without leaving the dashboard. Append push device tokens, or add chat endpoints per provider — a Slack channel or user, a Teams channel or user, a Telegram chat, or a plain webhook URL. Editing and deleting are inline too, so fixing a stale token is a two-click job.

  Share a connect link

  For Slack, Microsoft Teams and Telegram, generate a per-subscriber connect link and share it. Your subscriber completes the OAuth or Telegram linking on their own — no dashboard access required — and the credential lands back on their profile automatically.

  Prefer automation? Everything here is still available via the API read the subscriber credentials docs.

  Telegram Connect Components

  Telegram connect flow in the SDKs — @novu/js and @novu/react now expose the Telegram subscriber-link onboarding (deep link/QR, connection polling and expiry handling) so you don't have to build it yourself. Read More

  Improvements (8)

  • Actor variables in the workflow editor — use {{actor.firstName}}, {{actor.email}}, {{actor.subscriberId}} and more directly in step content on the new dashboard.

  • Ask AI now opens the docs assistant — the Command-K “Ask AI” action takes you straight to the Novu docs assistant for better answers.

  • Contexts is out of beta — the Contexts page is now generally available.

  • CLI connect matches the dashboard — npx novu connect now mirrors the dashboard's runtime grouping, and --runtime ai-sdk scaffolds a real AI SDK project.

  • Smoother agent channel onboarding — the channel picker opens on the first click, copy was standardized to “channel,” and connected agents get a guided “What's next” section.

  • Cleaner agent conversation timeline — managed and self-hosted agents now show the same flat, human-readable audit trail.

  • Zero-downtime API key rotation — create a second secret key, migrate your apps over, then delete the old one — rotate keys without any downtime.

  • Microsoft Teams multi-tenant distribution — distribute your Teams agent across tenants, with a Teams-specific subscriber-rollout onboarding guide.

  Fixes (9)

  • Workflow editor — switching to the HTTP request step via the breadcrumb no longer crashes the page.

  • Digest — monthly digests with valid days are no longer incorrectly rejected.

  • Workflows — the worker no longer crashes on legacy IN / NOT_IN step filters (common with webhook-based conditions).

  • Email — new-dashboard workflows using an email step with an email-webhook integration now send the content field instead of an empty body.

  • Inbox — the unread badge stays in sync after mark-as-read and mark-all-as-read, and sub-minute timestamps like “Just now” are now localized.

  • Inbox integration — clicking a production In-App integration card opens its config drawer (with the HMAC toggle) instead of the onboarding wizard, and the signed-out inbox embed link now redirects to sign in instead of showing a blank screen.

  • SendGrid — activity tracking captures every event when SendGrid batches them, fixing missing or duplicate message.seen / message.delivered events and outbound webhooks.

  • SMS — the AfricasTalking provider works again after a fix to its provider id.

  • Self-hosted email — custom-domain email delivery and inbound mail replies work on self-hosted enterprise.

• Jul 9, 2026

  Novu MCP OAuth

  Connect Cursor, Claude Code, ChatGPT, and other MCP clients to Novu with OAuth - no API key to copy, your organization picked up automatically on sign-in.

  Author:

  Himanshu Garg

  • MCP
  • Improvement

  

  The Novu MCP Server now supports OAuth for Novu Cloud. Point your AI client at the MCP URL, approve the sign-in prompt on first use, and you're connected — no secret key to copy, paste, or rotate.

  OAuth is the recommended path for interactive clients like Cursor, VS Code, Claude Code, and ChatGPT. API keys still work as a fallback for clients without remote OAuth, autonomous agents, and self-hosted Novu.

  Connect in one step

  Add the MCP URL for your region and save. Your client handles the rest — it prompts you to sign in to Novu the first time it calls a tool.

  {
    "mcpServers": {
      "novu": {
        "url": "https://mcp.novu.co/"
      }
    }
  }

  Use https://mcp.novu.co/ for US and https://eu.mcp.novu.co/ for EU — match the region of your Novu dashboard.

  Available on every Novu Cloud plan. Read the MCP connection guide.

• Jun 19, 2026

  Novu Chat SDK Adapter

  Bring your Chat SDK agent to Slack, Teams, WhatsApp, Telegram, and email: deliver multi-channel notifications from one trigger, resolve every channel to one unified subscriber, and drop in React connect components to put channels in front of your end-customers.

  Author:

  Dima Grossman

  • Agent Communication
  • New Feature
  • Chat

  The @novu/chat-sdk-adapter is now available. Wire it into your Chat SDK app and Novu manages credentials, identity, and delivery across Slack, Microsoft Teams, WhatsApp, Telegram, and email.

  npm install @novu/chat-sdk-adapter

  Multi-channel notifications from one trigger

  Define a workflow once in Novu with the channels you want, then fire a single trigger from any handler. Novu fans out to every step — Slack, email, WhatsApp, and more — and routes replies back through the same agent loop, so proactive notifications and conversational replies share one handler set.

  const ctx = getNovuContext(thread);
  
  // One trigger delivers to every channel in the workflow.
  await ctx.trigger("order-shipped", {
    payload: { orderId: "1234", trackingUrl: "https://example.com/track/1234" },
  });

  One unified subscriber across every channel

  Every channel resolves to a single Novu subscriber mapped to your own user, so your agent always knows who it's talking to — with email, phone, locale, custom data, and the canonical conversation history available inside any handler.

  const ctx = getNovuContext(thread);
  
  const subscriber = await ctx.getSubscriber(); // email, phone, locale, custom data
  const history = await ctx.getHistory();       // canonical transcript — ideal for LLM context

  Expose channels to end-customers with connect components

  Drop the prebuilt SlackConnectButton from @novu/react into your app so your end-customers can install and connect their own Slack workspace to your agent — OAuth, credentials, and Slack Connect handled by Novu. Microsoft Teams and Telegram connect buttons are in pre-release.

  import { SlackConnectButton } from '@novu/react';
  
  <SlackConnectButton
    integrationIdentifier={integrationIdentifier}
    connectionIdentifier={`${subscriberId}:${integrationIdentifier}:${agent.identifier}`}
    connectionMode="subscriber"
    connectLabel={`Install ${agent.name} ↗`}
    connectedLabel="Connected to Slack"
    onConnectSuccess={handleSlackOAuthSuccess}
  />

  Get started with npx novu connect --runtime chat-sdk, or read the connect components docs.

• Jun 16, 2026

  In-conversation MCP authorization and message queues

  Connect external MCPs during the conversation and process incoming messages one at a time for a more predictable chat experience.

  Author:

  Dima Grossman

  • MCP
  • Agent Communication

  Connecting external MCPs is now part of the conversation itself, instead of a separate setup step. When an agent needs access to a tool, it can prompt the user to connect it right at that moment and then continue the original request once access is granted. This makes the experience feel much more natural and reduces the friction of getting started with tool-powered workflows.

  We also introduced session-level tool access, so connected tools are available only where they are relevant. That gives users a clearer sense of control over what an agent can use during a conversation, while helping keep tool usage focused on the task at hand.

  

  Conversation queue

  We also improved how conversations behave when several messages arrive quickly. Messages are now processed in order, one at a time, instead of competing in parallel. This creates a more predictable experience in fast-moving chats and helps reduce confusing or out-of-sequence responses.

  Each queued message gets its own ⏳ indicator, and the indicator is removed when the message is processed.

  

• Jun 15, 2026

  Novu Connect

  Connect your AI agent to every channel your users already use, Slack, Microsoft Teams, WhatsApp, Telegram, and email, through one API. One agent, one synced conversation, live in minutes.

  Author:

  Dima Grossman

  

  Your AI agent can think. Now it can talk.

  Novu Connect is live: the communication layer for AI agents. One agent, every channel your users already use, held together in one synced conversation, through a single API. You bring the agent. Connect handles identity, threading, and delivery.

  Meet ACI: Agent Communication Infrastructure

  Every wave of AI infrastructure solved one connection. MCP connected agents to tools. A2A connected agents to other agents. ACI connects agents to people.

  Agent Communication Infrastructure is the layer that lets an agent hold a real, two-way conversation with humans on the channels they already use. Novu Connect is the first ACI layer. Learn about the category.

  

  One agent, every channel

  Reach your users on the surfaces they never close:

  • Slack: channels and DMs, answering in-thread with full context.
  • Microsoft Teams: the same agent inside the enterprise, with identity handled.
  • WhatsApp: a real back-and-forth, not a no-reply blast.
  • Telegram: fast, bot-friendly, community-native.
  • Email: the universal fallback, same thread, same context.

  Add a channel later, and your agent code does not change.

  

  One conversation, not five bots

  The hard part was never connecting a single channel. It was keeping one conversation coherent across all of them.

  Picture it: a user starts in Slack this morning, follows up from WhatsApp at lunch, and closes the loop by email tonight. To your agent, it is one thread. Same memory, same context. They never repeat themselves.

  

  That is the part that single-channel connectors cannot do. Identity resolution and threading are handled for you, so the conversation follows your user across channels.

  Live in minutes: three ways to start

  Pick the path that fits how you work.

  1. CLI. Run one command:

  npx novu connect

  2. Agent-first. Paste a prompt where your agent already lives: "Add an agent to my app https://novu.co/agents.md". Sixty seconds later, your agent is live on a real channel, no account or API key required.

  3. Dashboard. Set it up visually in the Novu dashboard.

  

  Bring your own brain

  The agent logic stays yours. Bring Claude or your own code, and Connect carries it across every channel. We never run your agent's brain. Claude Managed agents are supported out of the box, on a free tier.

  

  Same infrastructure, now two-way

  Connect runs on the same delivery infrastructure behind your Novu notifications. No new stack, no migration. The one shift: it carries two-way agent conversations, not just the outbound messages you already send.

  Connect your first agent at novu.co/connect. This is day one, with more agent runtimes and channels on the way.

• May 7, 2026

  Account Security Upgrades: Passkeys, Smarter Client Trust, zxcvbn, Turnstile

  Sign in with a passkey, skip Client Trust when 2FA is on, get real password-strength scoring at signup, and run into bot challenges only when traffic looks suspicious.

  Author:

  Dima Grossman

  • Dashboard
  • Improvement

  Four account-security improvements ship together today: passkey login, Client Trust deferring to 2FA, zxcvbn-ts password scoring, and a smart CAPTCHA on sign-up.

  Existing sessions are unaffected.

  Passkey Login

  Passkeys are now a supported authentication method for Novu accounts.

  Sign up with email and password or SSO as usual, then add a passkey from Account settings → Security.

  Your platform authenticator (Touch ID, Windows Hello, a hardware security key or a password manager like 1Password or iCloud Keychain) handles the rest.

  On your next sign-in, pick Sign in with passkey.

  Passkeys are built on WebAuthn. The private key never leaves your device, so there's nothing phishable for an attacker to capture on our side.

  You can register up to 10 passkeys per account, and they stack alongside your password and 2FA. Passkeys are an additional method, not a replacement.

  Client Trust Now Defers to 2FA

  Client Trust is our defense against credential stuffing: when someone signs in with a valid password from a new device, we send a one-time code to their email or phone.

  The catch was that this fired even on accounts with 2FA already enabled. Signing in from a new laptop meant two prompts: enter your TOTP code, then approve the new device.

  That's now collapsed into the regular MFA flow.

  If you have 2FA configured (TOTP, SMS or backup codes), Client Trust skips automatically. Your second factor already covers the new device.

  If you don't have 2FA enabled, behavior is unchanged: new devices still require a verification code by email or phone.

  This only applies to password sign-ins. Passkeys, OAuth and email links bypass Client Trust entirely.

  If you've been meaning to turn on 2FA, this is the nudge.

  Stronger Password Feedback via zxcvbn

  Password strength at signup, change and reset is now scored with zxcvbn-ts, the OWASP-recommended library for measuring real password entropy rather than pattern-matching "8 characters, one number, one symbol."

  You'll see live strength feedback as you type, and a prompt when a password technically meets the basic rules but is still weak (Password1!, qwerty123, dictionary words with predictable substitutions).

  This sits on top of our existing NIST-based minimum requirements.

  Smarter Bot Protection on Sign-up

  Sign-up is where bots show up first.

  We've moved off the old invisible CAPTCHA and onto a smart variant that uses CDN-level signals to decide whether a sign-up attempt looks suspicious.

  If it does, the user gets a quick interactive challenge (typically a checkbox). If it doesn't, which is most of the time, the challenge stays out of the way.

  Less friction for real users, more for the scripted ones.