What's new

AgentSIM is now agent-ready via auth.md. Agents can discover how to register, ask the user to approve access, and receive short-lived credentials for the API.

What's new

• Published https://agentsim.dev/auth.md and OAuth protected-resource metadata on the API host.
• Added service_auth registration for agents acting on behalf of a user by email.
• Added a dashboard claim page where the signed-in user enters the code shown by their agent.
• Issued short-lived agt_… bearer tokens that map back to normal AgentSIM accounts and API keys.
• Added JWT-bearer refresh so agents can renew access without asking the user to approve every hour.
• Agent-created credentials now appear in the API keys dashboard and can be revoked like any other key.

Existing asm_live_… API keys continue to work. anonymous registration and agent-verified ID-JAG flows are still roadmap items.

This release focused on making paid evaluation cleaner and making the dashboard playground safer to use during onboarding.

What's new

• Added a $9/month dedicated-number checkout flow with an isolated webhook path.
• Added a post-demo call-to-action in the playground for teams that need a dedicated number.
• Decoupled the playground demo from the live number pool so demo usage does not consume scarce pool capacity.
• Ensured playground demo sessions do not count against the free-session quota.
• Hardened Stripe metered billing so meter-event failures surface loudly instead of being silently swallowed.
• Updated dashboard copy to describe the substrate honestly as programmable numbers, not physical SIM or mobile-class numbers.
• Corrected carrier-audit classification and recorded substrate audit results more accurately.

This release sharpened the public product story around authorized fraud and security testing, while smoothing first-run onboarding.

What's new

• Added a dedicated fraud and security-testing use case page for trust, safety, and risk teams testing systems they own or are authorized to assess.
• Added welcome emails for new dashboard signups.
• Added first-touch attribution capture on signup so acquisition source is easier to understand.
• Polished the homepage hero with a subtle dot-grid texture.
• Fixed MCP deployment reliability by pinning the uv version and running from the project virtual environment.
• Corrected SDK snippets in public content so examples match the current client API.

AgentSIM now has a public changelog at /changelog, giving customers and agent builders a single place to track product changes.

What's new

• Added the public changelog timeline on the marketing site.
• Corrected OTP success recording when codes are consumed through the get_messages path, improving usage and delivery reporting accuracy.
• Continued cleanup of public documentation infrastructure so customer-facing docs stay separate from internal planning materials.

The marketing site received a new shared OG image layer — a single worker renders on-brand 1200×630 cards for every route instead of each page carrying its own bespoke image logic. The design uses the AgentSIM keypad mark with a cyan/green radial glow on a dark canvas.

Alongside that, the public docs were overhauled:

• Removed research and internal planning documents that had leaked into the published Mintlify site.
• Rewrote copy that overstated the substrate (removed "real SIM" language — these are Telnyx programmable numbers, not physical SIMs).
• Added an /about page on the marketing site.
• Blog posts were rewritten to match the accurate @agentsim/sdk API surface.

Several reliability and security issues were addressed across the API, dashboard, and MCP server.

Security

• API logs no longer emit sensitive request headers (authorization tokens, etc.).
• Tainted phone numbers — numbers that received SMS intended for another session — are now retired immediately and removed from the pool, preventing cross-tenant message exposure.

Billing

• Metered billing fallback path was hardened; existing Stripe customers are now redirected to the customer portal instead of a new checkout session.
• Plan tier is now queried from the database rather than an environment variable, fixing cases where the wrong quota was applied.
• Replenish retries no longer loop on provider ordering failures.

Dashboard

• Playground diagnostic endpoint added for verifying Stripe environment connectivity.
• Server Actions now log database errors instead of silently swallowing them.
• Upstream playground API calls include retry logic with diagnostics.

MCP server

• Railway start command was corrected to use the uv project venv Python binary.

A cluster of onboarding and playground improvements shipped across the 0.11–0.15 window.

Playground

• Full API key is now revealed in the playground (previously shown as a hint only).
• A welcome banner greets new users and explains what to do next.
• Simulate OTP button lets you test the full flow without provisioning a real number first.
• A countdown timer adds urgency cues during live sessions.
• Post-OTP CTAs guide users toward integrating the SDK.

Auth and onboarding

• New users are automatically redirected to the playground via an onboarded_at check on first login.
• Google OAuth state is now stored in a cookie, fixing state_mismatch errors on callback.
• Inbound SMS is now associated with recently-expired sessions (catches messages that arrive a few seconds after the TTL).

Sign-up

• Phone number field added to the sign-up form (used for account contact, not OTP).