Platform & Security Log

What changed across 5arz.

Dated release notes covering API authentication enforcement, credential metadata, and security hardening across 5arz surfaces.

Signing key: 5arz-oracle-2 (ES256) OpenAPI: api.5arz.com/openapi.json MCP: mcp.5arz.com

6 Nov 2026 Release · Live API + site + MCP

November release: one set of numbers, sign-in enforced, one MCP server

The API, the website and the MCP server now run from one release, and every public surface states the same facts.

Sign-in enforced: member routes require the member's own session, and business routes require the business's key.
Analytics only after consent: nothing loads from Google until a visitor clicks Allow, and fonts are served from 5arz.com.
Issuer metadata: /.well-known/jwt-vc-issuer is served as JSON and points verifiers to https://api.5arz.com/.well-known/jwks.json.
One OpenAPI document: https://api.5arz.com/openapi.json lists every public operation (80), generated from the API's own routes. 5arz.com/openapi.json redirects to it.
One MCP server: https://mcp.5arz.com carries all ten tools, including bind_human_to_payment. api.5arz.com/mcp forwards to it.
One set of numbers: the Free plan is 1,000 seals a month everywhere it is stated, and /signup is the one sign-up page.
Cash-out shown as paused: the site and the app no longer give a cash-out date. Every Star earned is recorded and stays with the member.

15 Oct 2026 Security API

Member account, debt and statement-upload routes now require the member's own session.

Member account and debt routes: a request without the member's session is refused, and one member cannot read another's records.
Debt-tool connections: tied to the signed-in member.

12 Oct 2026 Security API

Every route that records completed work or Stars now requires the member's own session.

Star-recording routes: task completion, surveys, skills and brand codes require the member's own session.
Account ownership: resuming an identity check and creating a business API key require proof that the caller owns the account.
Regression tests: automated security tests cover these routes.