Let the organization word the ribbon, and own the tab icon
"Welcome Back!" moves out of the root layout into PaneRibbon, a client component, because the wording is now the organization's to choose and this site learns i...
Carry the job advert through a sign-in, and land on the Careers tab
Somebody who presses Apply on the public careers board and already has an account reaches the register page, follows the sign-in link, and used to arrive on a d...
Fade the glimmer out at two corners, and cap it at half
The sheen now dies completely at the top-right and bottom-left corners and peaks, at half opacity, over the top-left and bottom-right. Each revolution reads as ...
Run a glimmer round the pane's gap every five seconds
A conic gradient centred on the pane, spun once per --glimmer-period, painted twice: a sweep filling the 15px gap, and a 2px rim on the pane's own border. The r...
Seat every screen in a rounded pane under a corner ribbon
Every route now renders inside .kamo-pane: a card inset 15px from the browser edge with a 14px radius, a soft shadow, and overflow:hidden, so a page's own conte...
Show the progressive lockout, so a held sign-in explains itself
The server now refuses sign-ins on a ladder — five free attempts, then five seconds, then locks of five, fifteen and thirty minutes, then a permanent block. Wit...
Drain on SIGTERM, answer a readiness probe, and run two pods
Next handles SIGTERM with a bare process.exit(143), so every deploy severed whatever this pod had in flight — a form post, a server action, a streamed RSC paylo...
Paint every logo on the sign-in site in the org's overlay colour
The org chooses "Login Site Logo Overlay" in kamo-internal beside the home page and loading screen overlays. One setting for the whole site: the sign-in form, t...
Answer the link in an address-change letter
/verify-email-change spends the token in a change-of-address letter and says what happened. It lives here rather than in the workspace because the letter goes t...
Let a signed-in member reach the sign-in form, and back out of the workspace picker
Two halves of the same problem: the login page was a one-way street. It validated any existing *** cookie on load and, when the session was still good, redirec...
Reveal the preselected workspace, and give the list the org's scrollbar
Two things about the workspace picker, both about the same list. The workspace a member used last is preselected and named on the button, because this screen i...
The workspace picker shows each org's logo
Two letters standing in for a logo was a workaround for the response not carrying one. It does now, resolved server-side from the folder the org's theme was pro...
Brand and scope the sign-in screen with ?org=
login.kamocrm.com is the sign-in screen for every organization that has no host of its own, so the hostname cannot say which one is signing in. ?org= does: it n...
Add the workspace picker
A sign-in that names no organization now comes back with a list instead of a session. This is the client half: /api/login passes that payload through (before th...
Rebuild the welcome panel around a live status rail
The left column was a generic headline, a security platitude and a pile of ambient decoration (dot grid, floating orbs, a pulsing dash). Replace it with one sha...
Replace the stock alert with an animated status plate
The inline sign-in messages ("Login successful! Redirecting...", "Invalid username and/or password.") used MUI's default Alert, whose pastel fill plus matching ...
Honour the org's sequential/shuffle slideshow order
config.json now carries backgroundOrder alongside backgroundImageCount. Shuffle re-randomises on every advance and never repeats the frame on screen; an absent ...
Forward the login host so recovery can resolve the org
Password recovery now accepts a member's primary mailbox address, which only names an account within one org. This proxy reaches SecurityService over cluster DN...
Complete a login that stopped at the second factor
SecurityService now gates login on a second factor (§164.312(d)). When one is owed it creates the session but withholds its one-time key, returning a short-live...
Add analytics analytics + ?registered=1 welcome notice
- Mount analyticsAnalytics client component in the root layout: next/script loader for analytics.kamocrm.com scoped via data-domains to login.kamocrm.com on...
Show TRIAL USE ONLY pill above Powered-by for trial orgs
Self-fetches /api/trial-status (proxy to SecurityService public trial-status endpoint, resolved by login host) and renders an amber pill above the Powered-by pi...
Kamo-login honors software auth logo + tab title
- DynamicMetaLoader: read software identity + auth selectors from config.json, set tab title from resolved name (authNameBrandSource), persist auth-logo state...
Show account-linked notice on ?linked=1
When register links an existing account to a new org, it redirects here with ?linked=1. Show "You already have a Kamo account — we've added this organization to...
Panel bleeds off-page left so its edge never shows on bounce; card fades ~250ms sooner
- Welcome/recover panel now extends --welcome-bleed (16rem) off the left edge with its right edge still pinned to --welcome-w; inner content padding is comp...
Choreographed entrance — panel springs in after bg loads, then card fades
Wait for the first background image (onLoad, with a 3s safety fallback), then spring-bounce the welcome/recover panel in from off-screen left (physics spring, s...
Pointer parallax (x+y) between welcome panel and background
Both layers drift with the pointer at different rates and opposite directions via framer springs. Background is scaled 1.12 and the welcome panel is oversized 1...
Move animated logo to bottom-right, centered above Powered-by pill
PoweredByKamo gains an optional logoSlot rendered centered directly above the pill within its fixed bottom-right anchor (other pages unaffected). The animated l...
Left-pinned translucent welcome panel + centered rounded form card
Welcome/Recover panel now full-height, flush to the left edge, on top of the background image with a translucent wash and square corners; hidden on mobile. Anim...
Route paid signups to checkout after login
After successful auth (manual or auto-login), consume the apex-domain sp_checkout_plan cookie left by kamo-register and redirect the buyer to the brand /subscri...
Use org short name and description in HTML head
DynamicMetaLoader now sets document.title to "Login - {siteNameShort}" and writes the org description into the meta description tag. Static layout.tsx fallback ...
Reset Capcha *** after every failed login attempt
Users must re-verify they are human after each incorrect password. Calls widget.reset() and clears CapchaVerified/payload state on both credential failures and ...
Lock form and auto-proceed after Capcha when submitting early
If the user submits before the Capcha widget is verified, the form is now disabled and the widget is triggered programmatically. Once verification completes the...
Show verified banner and pre-fill email after email verification
Reads ?email_verified=1&email=... from URL on mount, shows a success alert, pre-fills the username field, then cleans the URL.
Add /reset-password page, update Forgot Password link
Three-stage email password reset: email form → 8-char code entry → new password. Auto-verifies token from URL. Glass-morphism card, background carousel, Capcha ...
Redirect Forgot Password to register.{domain}/recover
Uses the existing replaceDeepestAlias pattern, consistent with the register link. Password reset now lives on kamo-register.
Replace EMAIL_NOT_VERIFIED error with rich verification card
When login fails with EMAIL_NOT_VERIFIED the login card is now replaced by a polished "Check your inbox" screen: animated envelope SVG with opening flap and flo...
Wire real API calls into /recover page (SP3)
Replaces all fakeSubmit() stubs with recoveryApi calls. Adds SMS OTP verify phase, seed email input, new-password step, and token landing via ?token= URL param.
Add subtle KamoCRM backlink to auth pages
Adds a small "Powered by KamoCRM" style footer badge to the three user- facing auth surfaces (login, recover, validate). Since kamo-login is the shared white-la...
Add ?next= forward parameter support for post-login redirect
Captures ?next=/path from URL and carries it through both manual login and auto-login flows, appending it to the OTK redirect URL so kamo-internal can redirect ...
Replace Capcha npm package with private-labeled kamo-capcha-widget fork
Switched from upstream Capcha npm package to our MIT-forked kamo-capcha-widget with all branding stripped at source. Removed shadow DOM hacks and CSS overrides ...
Integrate Capcha proof-of-work *** widget into login and recovery pages
Add USERNAME and REMEMBER_ME cookies with domain-specific settings
- Set USERNAME cookie when remember me is checked on successful login (1 year expiration) - Clear USERNAME cookie when remember me is unchecked on any login att...
Add domain-agnostic IngressRoute for automatic SSL and routing
- Added k8s/ingressroute.yaml with HostRegexp pattern for login subdomain - Updated CI/CD to deploy IngressRoute automatically - Enables Cloudflare-like automat...
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.