Changelog
What we have told developers about EAuth, newest first: every change to the terms, every new sub-processor and every change that touches integrations, with the day it takes effect. Each was also sent by mail to the address on every account, with the notice the terms promise: 30 days for the terms (14.1) and for a sub-processor (8.5), 90 days for a change that breaks integrations (2.3).
3 October 2026
- EAuth moves to eauth.me. The issuer is
https://eauth.me. Every request to auth.elchi.dev is answered with a permanent redirect to the same path on eauth.me (terms 1.6 and 1.7, clause 2.4). - Terms 1.8. The companies that run our cluster are listed under Sub-processors (8.6). The status page at status.elchi.dev is live (4.3).
- Only confirmed addresses. An application gets no tokens for an
account whose email address is not confirmed, so
email_verifiedis always true in the tokens of a sign-in. Someone who has not confirmed is asked to on the way back to the application; withprompt=nonethe application getsinteraction_required.
None of these was announced ahead or sent by mail: on that day every application registered with EAuth belonged to Elchi Studios, and no one outside Elchi Studios had an account, so nobody else was affected.
No notices yet.