Word the page for a first password when the link says setup=1
A member an administrator added has never had a password, so the welcome letter's link opens the same page worded as Set, not Reset.
Consent for Google Home — every sentence names the assistant being linked
The iot.google client (purpose IOT_GOOGLE) gets its own wording: "Link Kamo to Google Home", "What can Google Home use?", default link names "Google Home" / "<F...
Consent for the KamoUniverse Assistant skill, and the decision route forwards whose link it is
Client iot.alexa.assistant (the second, assistant-only Alexa skill) always links "Just me": no owner cards, no place, no "What can Alexa use?", no routines; a d...
Alexa consent asks whose link it is, which place, and what Alexa can use
Voice Assistant program (P1-6, P2-8, P5-3): "Just me" or "The organization" cards, the place whose devices an organization link sees, "What can Alexa use?" (pre...
OAuth mode — the standard page untouched, tenant chrome off (IoT SP09)
/?oauth_request=<64 hex> is the OAuth sign-in page by a beforeFiles rewrite in next.config.mjs to /oauth/sign-in (the browser keeps the URL), not by a switch in...
The OAuth sign-in with the missing MFA step, and the consent screen (IoT SP09)
/api/login, /api/session/select and /api/login/mfa accept an optional oauthRequestId (64 hex). Absent, nothing changes (tests/***-cookie pins each route's answe...
/oauth/authorize, /token and /revoke, one shared session-cookie writer (IoT SP09)
The Kamo OAuth server's public endpoints, relayed to SecurityService (O1, O6, O7) over cluster DNS at SECURITY_SERVICE_URL (default kamowssecurity-service, as a...
The sign-in screen credits KamoUniverse and falls back to its apex
kamouniverse.com is now the platform's primary apex (kamocrm.com stays a fully served legacy apex): - Theme.tsx: PLATFORM_APEX, the theme host used before the ...
Send a universe sign-up to its checkout, or to create its organization
kamo-register parks a paid sign-up's plan in sp_checkout_plan, and the KamoUniverse site's plans are the universes' own (family_premium, community_starter, pers...
Login.kamouniverse.com wears the KamoUniverse brand
login.kamouniverse.com is the platform's KamoUniverse sign-in door. Its host resolves to the platform organization, so the by-host lookup would answer "crm" and...
Sign-in logos load a pre-sized copy, and the original when it is missing
Each theme folder now carries img/sized/<stem>/h<rung>.webp beside every logo. A PNG org's logo.svg / logo-full.svg is its whole upload wrapped in base64 (sever...
Point a member who typed their work email at their personal one
Forgot-password resets go to the address on the user account, usually a personal one, but members type the work address their organization gave them. SecuritySe...
Let the organization word the ribbon, and own the tab icon
"Welcome Back!" moves out of the root layout into PaneRibbon, a client component, because the wording is now the organization's to choose and this site learns i...
Carry the job advert through a sign-in, and land on the Careers tab
Somebody who presses Apply on the public careers board and already has an account reaches the register page, follows the sign-in link, and used to arrive on a d...
Fade the glimmer out at two corners, and cap it at half
The sheen now dies completely at the top-right and bottom-left corners and peaks, at half opacity, over the top-left and bottom-right. Each revolution reads as ...
Run a glimmer round the pane's gap every five seconds
A conic gradient centred on the pane, spun once per --glimmer-period, painted twice: a sweep filling the 15px gap, and a 2px rim on the pane's own border. The r...
Seat every screen in a rounded pane under a corner ribbon
Every route now renders inside .kamo-pane: a card inset 15px from the browser edge with a 14px radius, a soft shadow, and overflow:hidden, so a page's own conte...
Show the progressive lockout, so a held sign-in explains itself
The server now refuses sign-ins on a ladder — five free attempts, then five seconds, then locks of five, fifteen and thirty minutes, then a permanent block. Wit...
Drain on SIGTERM, answer a readiness probe, and run two pods
Next handles SIGTERM with a bare process.exit(143), so every deploy severed whatever this pod had in flight — a form post, a server action, a streamed RSC paylo...
Paint every logo on the sign-in site in the org's overlay colour
The org chooses "Login Site Logo Overlay" in kamo-internal beside the home page and loading screen overlays. One setting for the whole site: the sign-in form, t...
Answer the link in an address-change letter
/verify-email-change spends the token in a change-of-address letter and says what happened. It lives here rather than in the workspace because the letter goes t...
Let a signed-in member reach the sign-in form, and back out of the workspace picker
Two halves of the same problem: the login page was a one-way street. It validated any existing *** cookie on load and, when the session was still good, redirec...
Reveal the preselected workspace, and give the list the org's scrollbar
Two things about the workspace picker, both about the same list. The workspace a member used last is preselected and named on the button, because this screen i...
The workspace picker shows each org's logo
Two letters standing in for a logo was a workaround for the response not carrying one. It does now, resolved server-side from the folder the org's theme was pro...
Brand and scope the sign-in screen with ?org=
login.kamocrm.com is the sign-in screen for every organization that has no host of its own, so the hostname cannot say which one is signing in. ?org= does: it n...
Add the workspace picker
A sign-in that names no organization now comes back with a list instead of a session. This is the client half: /api/login passes that payload through (before th...
Rebuild the welcome panel around a live status rail
The left column was a generic headline, a security platitude and a pile of ambient decoration (dot grid, floating orbs, a pulsing dash). Replace it with one sha...
Replace the stock alert with an animated status plate
The inline sign-in messages ("Login successful! Redirecting...", "Invalid username and/or password.") used MUI's default Alert, whose pastel fill plus matching ...
Honour the org's sequential/shuffle slideshow order
config.json now carries backgroundOrder alongside backgroundImageCount. Shuffle re-randomises on every advance and never repeats the frame on screen; an absent ...
Forward the login host so recovery can resolve the org
Password recovery now accepts a member's primary mailbox address, which only names an account within one org. This proxy reaches SecurityService over cluster DN...
Complete a login that stopped at the second factor
SecurityService now gates login on a second factor (§164.312(d)). When one is owed it creates the session but withholds its one-time key, returning a short-live...
Add analytics analytics + ?registered=1 welcome notice
- Mount analyticsAnalytics client component in the root layout: next/script loader for analytics.kamocrm.com scoped via data-domains to login.kamocrm.com on...
Show TRIAL USE ONLY pill above Powered-by for trial orgs
Self-fetches /api/trial-status (proxy to SecurityService public trial-status endpoint, resolved by login host) and renders an amber pill above the Powered-by pi...
Kamo-login honors software auth logo + tab title
- DynamicMetaLoader: read software identity + auth selectors from config.json, set tab title from resolved name (authNameBrandSource), persist auth-logo state...
Show account-linked notice on ?linked=1
When register links an existing account to a new org, it redirects here with ?linked=1. Show "You already have a Kamo account — we've added this organization to...
Panel bleeds off-page left so its edge never shows on bounce; card fades ~250ms sooner
- Welcome/recover panel now extends --welcome-bleed (16rem) off the left edge with its right edge still pinned to --welcome-w; inner content padding is comp...
Choreographed entrance — panel springs in after bg loads, then card fades
Wait for the first background image (onLoad, with a 3s safety fallback), then spring-bounce the welcome/recover panel in from off-screen left (physics spring, s...
Pointer parallax (x+y) between welcome panel and background
Both layers drift with the pointer at different rates and opposite directions via framer springs. Background is scaled 1.12 and the welcome panel is oversized 1...
Move animated logo to bottom-right, centered above Powered-by pill
PoweredByKamo gains an optional logoSlot rendered centered directly above the pill within its fixed bottom-right anchor (other pages unaffected). The animated l...
Left-pinned translucent welcome panel + centered rounded form card
Welcome/Recover panel now full-height, flush to the left edge, on top of the background image with a translucent wash and square corners; hidden on mobile. Anim...
Route paid signups to checkout after login
After successful auth (manual or auto-login), consume the apex-domain sp_checkout_plan cookie left by kamo-register and redirect the buyer to the brand /subscri...
Use org short name and description in HTML head
DynamicMetaLoader now sets document.title to "Login - {siteNameShort}" and writes the org description into the meta description tag. Static layout.tsx fallback ...
Reset Capcha *** after every failed login attempt
Users must re-verify they are human after each incorrect password. Calls widget.reset() and clears CapchaVerified/payload state on both credential failures and ...
Lock form and auto-proceed after Capcha when submitting early
If the user submits before the Capcha widget is verified, the form is now disabled and the widget is triggered programmatically. Once verification completes the...
Show verified banner and pre-fill email after email verification
Reads ?email_verified=1&email=... from URL on mount, shows a success alert, pre-fills the username field, then cleans the URL.
Add /reset-password page, update Forgot Password link
Three-stage email password reset: email form → 8-char code entry → new password. Auto-verifies token from URL. Glass-morphism card, background carousel, Capcha ...
Redirect Forgot Password to register.{domain}/recover
Uses the existing replaceDeepestAlias pattern, consistent with the register link. Password reset now lives on kamo-register.
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.