# Changelog Changes to the API, MCP server, SDKs and developer documentation, newest first. ## 2026-10-28 - **Scopes:** `domains:registrant` (new, personal tokens only) for the four [domain registrant dossier](/en/docs/domain-registrant) routes, split from `domains:owner`; `domains:write` is now labelled "Register, renew and manage domains"; `orders:write` (new) for [quotes](/en/docs/api/post-quote), [carts](/en/docs/api/post-carts) and [orders](/en/docs/api/post-order) — orders that charge the balance also need `billing:write`. ## 2026-10-27 - **Identity & SSO:** OAuth access tokens and ID tokens last 86400 seconds (24 hours) by default, not 3600: corrected in [Sign in with Tino](/en/docs/oauth), [Sign in from a CLI](/en/docs/cli-login), [MCP](/en/docs/mcp), [SDK](/en/docs/sdk). Still read `expires_in` from each response instead of hard-coding it. - **TinoPay, TinoPage Builder, TinoWAF:** the `/v1` gateway opens the three services' routes to OAuth app tokens and personal API tokens, with new scopes `tinopay:read`, `tinopay:write`, `tinopay:owner` (personal tokens only), `builder:read`, `builder:write`, `waf:read`, `waf:write`: table in [Sign in with Tino](/en/docs/oauth), [Getting started with TinoPay](/en/docs/tinopay-start), [Getting started with TinoPage Builder](/en/docs/builder-start). - **MCP server:** [Connect Claude, ChatGPT to Tino (MCP)](/en/docs/mcp): other MCP apps sign in with OAuth by registering a client themselves (`POST https://api.tino.vn/oauth/register`, RFC 7591); a personal API token is the alternative. Claude Code identifies itself with a Client ID Metadata Document and by default requests every scope the MCP server lists, write scopes included. - **Identity & SSO:** new page [Sign in from a CLI or an app without a backend](/en/docs/cli-login): app self-registration (`POST https://api.tino.vn/oauth/register`, RFC 7591), device code sign-in (RFC 8628: `POST /oauth/device_authorization`, the customer enters the code at `https://auth.tino.vn/oauth/device`, the CLI polls `POST /oauth/token`), examples in bash, Node.js, Python. [Sign in with Tino](/en/docs/oauth) lists the two new endpoints and the `urn:ietf:params:oauth:grant-type:device_code` grant. - **Domains:** new page [Domain registrant dossier](/en/docs/domain-registrant) and 4 routes: [domains awaiting their dossier](/en/docs/api/get-domains-pending), [read](/en/docs/api/get-domains-id-registrant) and [save the registrant](/en/docs/api/put-domains-id-registrant) of a waiting domain, [registrants used before](/en/docs/api/get-registrants); all four need `domains:owner` (personal API tokens only), and ID numbers in `reason` are masked. Whois lookup can also be called through `/v1` with a token: [`GET /v1/whois/{domain}`](/en/docs/api/get-v1-whois-domain). - **TinoWAF, TinoPay, MCP:** API section [TinoWAF](/en/docs/waf): 19 routes `/v1/service/{id}/waf/…` (websites, protection level, emergency anti-attack mode, domain names, origin servers, event log, IP block/allow list), scopes `waf:read`, `waf:write`. TinoPay adds 9 routes: [payment code patterns](/en/docs/api/tinopay-get-pay-codes), [Sapo integrations](/en/docs/api/tinopay-get-sapo-integrations), [Sapo reconciliation log](/en/docs/api/tinopay-get-sapo-order-logs). The [MCP](/en/docs/mcp) page adds the tools of the 6 TinoPay, TinoPage Builder, TinoWAF scopes. ## 2026-10-26 - **Domains:** new page [Domain whois lookup](/en/docs/api/get-whois-domain) (`GET https://api.tino.vn/whois/`): a public route with no token; how to read `available`, `error` and `raw` when rate-limited. - **TinoPage Builder:** new section: [Getting started with TinoPage Builder](/en/docs/builder-start) and a page for each of the 14 routes of the service API `https://api.tino.vn/service//builder/…` (account overview and limits, websites, AI website creation, publishing, pausing, deleting, custom domains, contacts and orders, one-time sign-in tickets), called with the service owner's sign-in token. ## 2026-10-24 - **Tino Uptime:** new section: [Getting started with Tino Uptime](/en/docs/uptime-start) and a page for each of the 20 routes of the service API `https://api.tino.vn/service//uptime/…` (plan, usage, monitors, uptime, check results, incidents, alert channels), called with the service owner's sign-in token. ## 2026-10-22 - **TinoPay:** merchant routes dropped the `/v2/services` prefix and are now `https://api.tino.vn/service//tinopay/…`; the old path returns 404 `invalid method`. Added 11 routes: [Telegram, Zalo and Lark notifications](/en/docs/tinopay-notifications) and [API tokens](/en/docs/tinopay-start#api-tokens). Identify the TinoPay service by `product_type` (`tinopay`) instead of the service name; set timeouts to at least 100 seconds ([Getting started with TinoPay](/en/docs/tinopay-start)). ## 2026-10-21 - **Documentation:** developers.tino.vn has a page for every route of the `/v1` gateway (parameters, cURL, JavaScript, PHP, SDK examples, sample response), an [API Reference](/en/docs/reference) by product, [OpenAPI 3.1](/en/openapi.json), `llms.txt` and a Markdown version of every page. - **Documentation:** added the pages [Connect Claude, ChatGPT to Tino (MCP)](/en/docs/mcp), [Personal API tokens](/en/docs/personal-tokens), [SDKs & examples](/en/docs/sdk), [Test environment](/en/docs/sandbox). - **Docs:** TinoPay section: [Getting started with TinoPay](/en/docs/tinopay-start), [Receiving TinoPay webhooks](/en/docs/tinopay-webhook) and a page for every route of the TinoPay merchant API. ## 2026-10-20 - **Sign in with Tino:** OAuth 2.0 Authorization Code + PKCE (S256) and OpenID Connect; issuer `https://api.tino.vn`, sign-in and consent page `https://auth.tino.vn/oauth/consent`. See [Sign in with Tino](/en/docs/oauth). - **Gateway `/v1`:** call the API on the customer's behalf at `https://api.tino.vn/v1/`; each route needs a scope, and a route outside the token's scopes returns 403 `insufficient_scope`. See [Calling the Tino API](/en/docs/api). - **Personal API tokens** (`tinopat_`): customers create them at `https://auth.tino.vn/en/me/security` and choose scopes, expiry and IP restriction; only personal tokens can have the `domains:owner` scope, and it requires an IP restriction. - **MCP server** `https://api.tino.vn/mcp`: Claude, Claude Code and ChatGPT sign in with OAuth; other MCP apps use a personal token. There is no tool for cancelling services. ## SDK 1.2.0 (2026-10-13) - The `backorder` group: .vn domain auctions. Version 1.2.0 is on PyPI; npm and Packagist are at 1.1.0. ## SDK 1.1.0 (2026-08-04) - Phone number verification for the account; the code is sent through Zalo, or by SMS if the number has no Zalo account. ## SDK 1.0.0 (2026-08-02) - Python, Node.js and PHP SDKs and contract documents for each operation: [tinovn/tino-sdk](https://github.com/tinovn/tino-sdk).