Octeth v6.0.4 is out today, two days after v6.0.3.
v6.0.3 was a small corrective patch, so it shipped early. That left most of the current two-week cycle for this release, and v6.0.4 is where that work lands: Keitaro tracking for SMS campaigns, test sends that only reach numbers you have verified, an API reference you can try from inside the new interface, and a solid round of security hardening.
Keitaro Tracking for SMS Campaigns
For teams that send offers by SMS, the number that matters is not the click, it is the conversion, and many of them track it in Keitaro. Until now, the SMS report in Octeth and the conversion data in Keitaro lived in two different places, and someone had to line them up by hand.
In v6.0.4, each account can connect its own Keitaro tracker from a new Integrations section in the new interface. From then on:
- Every recipient gets their own tracking code. Put the tracking code tag in a link and each message carries a code that ties the recipient to what they do in Keitaro.
- Conversions come back to Octeth. Keitaro reports each conversion to Octeth as it happens, including its status, and Octeth regularly collects the clicks Keitaro recorded.
- The SMS campaign report shows the result. Keitaro clicks, conversions, the statuses each conversion reached, and revenue, per campaign and per link.
- Segments can use it. You can target contacts who clicked or converted in Keitaro, or who did not, and narrow it to a conversion status. A follow-up to the people who reached one conversion status but not the next is now a segment, not a spreadsheet.
Each account connects its own tracker and keeps its own data. The API key it enters is stored encrypted and is never shown again, and the incoming conversion reports are checked against the account and the recipient's code before anything is written.
One detail worth knowing: links with the tracking code are sent exactly as written. They skip your short link domains, so the tracker sees the link it expects. The composer says so when you use the tag. The Keitaro guide walks through connecting a tracker and reading the report.
SMS Test Sends to Verified Numbers
Sending a test before a campaign is something everyone does for email. For SMS it was harder than it should have been, and it was also a risk: a test endpoint that sends to any number is a tool someone can misuse.
The SMS composer now has a Send a test button. It shows the message exactly as it will arrive and what it will cost, and then sends one copy to one of your own test numbers. To add a test number, you verify it with a six-digit code sent to that phone. Each account can keep up to five, and administrators set the daily test limit and the time between tests in the SMS settings.
The same rule applies through the API: test messages now go only to verified numbers. If you have an integration that sends SMS tests, it needs to verify its numbers after the upgrade, before its next test. The guide to sending a test shows the flow.
An API Reference and Playground in the New Interface
Octeth has always been an API-first product. Many of our clients run it behind their own systems and never touch the interface for day-to-day sending. But to learn the API, you had to leave the product, read the docs, and then try requests from a terminal.
The API page of the new interface now lists every command a user API key can call, with its parameters and examples, and lets you send real requests with your own key. Commands that only read data run in one click. Commands that change data ask you to type the command name first, so nobody deletes a list by exploring. The reference is built from the same documentation we publish, and our test suite fails if an API command is missing from it, so the two cannot drift apart.
Security Hardening
A good part of this release is security work. None of it changes how a normal user signs in or sends, but each item closes a gap:
- Every API parameter has a shape. A parameter that takes a single value now refuses an array or an object, and the check runs before the request is even authenticated.
- Ids are plain numbers. API commands check ownership and act on the same numeric id, and unusual number formats are refused.
- Revoked sessions stay revoked. Signing out or revoking a session in the new interface also ends it in the API and the classic user area, and switching between saved accounts no longer signs a revoked one back in.
- A safer Remember me. The classic user area now remembers a browser with a random token kept on the server. It expires after 14 days and is revoked on sign-out, a password change, enabling two-factor authentication, or when the account is disabled.
- Single sign-on tokens work once. Each token is valid for one sign-in and at most five minutes, checked against the server's clock.
- Stored secrets are no longer displayed. Settings pages, including plugin settings, stop showing saved API keys, passwords and webhook URLs.
- Sub-administrator limits reach further. More admin commands now respect the user groups a sub-administrator is allowed to manage, and the administrator password reminder gives the same answer for every address.
If You Run Octeth for Others
Some of these changes alter how the API answers, and three are likely to need attention before you upgrade. Requests that send an array for a single-value parameter are refused by default, with a setting that logs them instead while an integration is corrected. SMS test sends through the API only reach verified numbers. Single sign-on tokens are single-use, so a broker must create one per sign-in.
Please read the Upgrade Notes in the changelog and the API behavior changes page before you upgrade an installation that other systems call.
Smaller Things Worth Knowing
- Campaigns pause during upgrades. The upgrade offers to pause campaigns that are sending, lets their current batches finish, and resumes exactly those campaigns at the end.
- Tracking links always resolve. Campaigns sent from a sender domain whose verified records lack the tracking host now use the fallback tracking host, and the new interface warns about such domains.
- Journey enrollees per campaign. A campaign can include or exclude contacts who are in a journey, or follow each list's own setting.
- Soft bounces are treated consistently. Soft-bounced subscribers show as Active with a badge and receive journey emails and SMS, the same as campaigns.
- Abuse reports trace back to the sender. Email gateway messages carry a signed abuse identifier, so staff can find the account behind a forwarded complaint.
- Excel CSV files import. The import wizard accepts files saved in Windows-1252 or UTF-16.
- Subscriber activity is fuller. The Activity tab now lists campaign sends and bounces.
What Comes Next
The next release is due on November 8, on the usual two-week schedule. If you connect Keitaro or try the API playground, I would like to hear how it fits your workflow.
Already an Octeth client? Log in to the Octeth Client Area to download v6.0.4.
Running your own email and SMS infrastructure and want to see what Octeth looks like on it? Tell us about your setup through the contact form at octeth.com/demo/.
