Appwrite, the open-source backend platform for web and mobile applications, has released version 2.3 with changes that require a mandatory migration for all self-hosted installations.
The most consequential change is the complete removal of Dev Keys. These keys — which previously bypassed CSRF protection, origin checks, redirect-URI validation, and abuse limits — had already been disabled for new creation but were still accepted. Version 2.3 deletes all Dev Key data, endpoints, headers, and URL parameters. Any integrations relying on them must be updated before upgrading.
Other notable changes in 2.3: - Console URL configuration is now centralized via _APP_CONSOLE_URL, which Appwrite uses to generate OAuth2 redirect targets and email links. The legacy _APP_CONSOLE_URL_SCHEME variable is removed. - Function duration now includes cold-start time, regardless of whether the invocation is synchronous or asynchronous. Users should expect higher reported runtime and compute usage for affected functions. - Native login via ID tokens now encrypts and stores the verified token in user identity, refreshing it on each login. Applications can read additional token claims (e.g., a Google account's language setting). This endpoint now accepts only Apple and Google as providers. - Appwrite Sites adds support for Jaspr, enabling server-side rendered Dart applications (requires the Flutter 3.44 runtime). - A nightly release channel is available for self-hosted instances (unsupported, patch-version-locked; stable remains the default).
The required migration script removes Dev Key data and adds new attributes to user and identity tables across all projects. Appwrite recommends backing up data and testing the migration outside production before upgrading.
