Changelog

Entries name what a developer can see or use. Internal changes are not listed.

12 November 2026

• The Claude Code plugin brings Toolaby's docs server, and acts with the command line. Its skills and five commands are as they were. Its one MCP server is the docs, at https://toolaby.app/api/mcp, and its commands run npx -y toolaby@latest as shell commands you see, and approve unless you have allowed them. It no longer carries the server that acts: for the toolaby_* tools in Claude Code, add it with claude mcp add --scope user toolaby -- npx -y toolaby@latest mcp, or npx -y toolaby@latest agents. See Build with an agent.

27 October 2026

• Your extension on Microsoft Edge. A tool names its Microsoft Edge Add-ons listing beside its Chrome Web Store one, under Settings → Store, with npx -y toolaby@latest tool update <tool-id> --edge-url <listing address> from the command line 1.18.0, or with toolaby_update_tool. Edge gives the extension an id of its own: your tool key then works from the Edge copy as from the Chrome one, a purchase made in Edge reaches it, and a buyer in Edge is sent to the Edge listing. See Ship to the Chrome Web Store.

23 October 2026

• Your server counts uses with its secret key. POST /api/v1/tools/{tool}/uses counts a signed-in buyer's uses, and GET reads them without counting, with your workspace's secret key and the buyer's site token as Toolaby-Site-Token. A site token is made for your page, and anything that runs there could read it: with the key required, it cannot count anyone's uses without your server. /api/me/uses, which took the token alone, is deprecated: it answers until 1 December 2026, with Deprecation and Sunset headers, and is refused after. See Your server and API.
• Your extension can work through your own server. toolaby.siteToken({ audience }) gives a signed-in extension a five-minute site token for one of your own pages, naming the buyer, the extension (azp) and the device (ins). Your server checks it as a page's, and counts that buyer's uses with it, on the same count as the page. A device past the account's device limit gets ent: false. See Your server.
• A refusal is not kept for its Idempotency-Key when uses are counted: it counted nothing, so the same key asks again, and a buyer who pays in between is let through instead of refused for the rest of the day.
• Reading uses without counting answers what is left of the buyer's free uses, and every answer now carries used, per and, for a period, window and resetsAt. toolaby.noteUses(answer) takes that answer into the extension's meter, so getUser().usage and the account line say what your server counted. See Client.
• signOut() in the background now signs the device out on the account too, as it always did from a page.
• Web apps in Analytics. Toolaby.checkIn(), Toolaby.paywallShown() and checkout({ feature }) count a web app's signed-in buyers beside the extension's devices, by a keyed hash of their account, with nothing kept in their browser. The pages that count devices offer All · Extension · Web app, and the CSV files, the API and the command line 1.17.0 take channel. A web buyer counted is a device of the month, as Limits counts them. See Analytics.

22 October 2026

• An Idempotency-Key names one action on POST /api/me/uses. The same key with another count is refused with 400 (idempotency_mismatch), as Stripe refuses a key reused with other parameters, and Your server says to make the key from what the action counts, never from the browser unchanged.
• Site tokens, for a web app's own server. Toolaby.token({ tool }) gives your page a five-minute token naming the signed-in buyer. Your server checks it with the tool's published keys, and sends it to POST /api/me/uses to count that buyer's free uses, per account and in the tool's period, with an optional Idempotency-Key. A buyer who holds the tool counts nothing. See Your server.

19 October 2026

• Uninstalls on Hobby. Analytics' Uninstalls, with the reasons people gave and what they wrote, comes with Hobby as well as Pro, as do the mail when a paying buyer leaves and the device.uninstalled event. Answers given before today are there already: every part counts on every plan. See Plans.

16 October 2026

• Analytics, under the dashboard's Analytics tab, for all your tools or one: active devices, the way from a new device to a purchase, revenue and monthly recurring revenue with thirteen months read from Stripe, what opened the paywall before each sale, uninstalls with the reasons people gave, and each build's devices and sales. Devices are counted for each tool you turn counting on for under Configure → Settings → Analytics, once your privacy policy says what is counted. See Analytics.
• The uninstall page. When someone removes your extension, Chrome opens a short page in their language that asks why, and shows a buyer still paying how to stop. A mail tells you when a paying buyer leaves. See Analytics.
• The funnel leaves out devices that have the tool another way, by a licence, a subscription or access you gave, and counts them apart: they never needed the paywall. A trial stays in. The API's funnel counts them in has_access_elsewhere. See Analytics.
• Three webhook events: subscription.renewed, payment.failed and device.uninstalled (a paying buyer's device). An endpoint that asked for every event receives them. See Webhooks.
• Analytics in the API and the command line: GET /tools/{tool}/analytics and its tables, npx -y toolaby@latest analytics <tool-id> from the command line 1.16.0, and toolaby_analytics for agents. See API.
• A deleted tool's id, and a deleted workspace's address, are never used again, by you or anyone: copies of a deleted tool still out there reach no other tool, and its Analytics is deleted with it.
• The client counts its paywall, and sets the uninstall page where toolaby.config.js says uninstallPage: true. npx -y toolaby@latest upgrade <tool-id> puts it in your extension and writes that line: false where your code calls chrome.runtime.setUninstallURL() itself, so Chrome's setting stays your code's.

15 October 2026

• Toolaby's docs in Claude's connector directory. In Claude on the web, desktop or mobile, connect Toolaby from the directory, with no sign-in: Claude then searches and reads these docs when you ask how to sell an extension. See Build with an agent.
• The MCP server in the official MCP Registry, as app.toolaby/toolaby, from the command line 1.15.1, beside the docs as app.toolaby/docs.
• The Claude Code plugin carries the command line it runs, so nothing is downloaded when Claude Code starts it: /plugin marketplace add toolaby/claude-plugin, then /plugin install toolaby@toolaby. See Build with an agent.
• A free starter, Toolaby/chrome-extension-starter: a WXT and React extension with a Free plan, a daily allowance and a Pro feature already wired. npm run setup signs you in, makes your tool and wires it.
• The extension generator, at toolaby.app/create: the starter with your extension's name, colour, pages and prices, downloaded as a zip made in your browser, with no account. Its npm run setup makes those plans on Test.

10 October 2026

Toolaby launches. What is there from the first day:

• The dashboard, on Test at toolaby.app/test/dev and on Live at toolaby.app/dev: tools, pricing, customers, members, webhooks and API keys. See Test and Live.
• The command line: npx -y toolaby@latest wire, create, check, pack and upgrade. See Command line.
• No permission warning from Toolaby. Wiring adds the storage permission and Toolaby's address under externally_connectable, and no host permission, so Chrome shows your users nothing for Toolaby at install or on an update. upgrade takes out a host permission an earlier wiring gave Toolaby's address. See Quickstart.
• The extension client, one file: toolaby.js, with gate(), has(), getUser(), getPlans() and showPaywall(). See Client.
• A move from ExtensionPay: wire --from-extensionpay keeps an extension's ExtPay code and answers it with Toolaby, and copies its plans. See Move from ExtensionPay.
• Subscriptions moved from another Stripe account, such as the one ExtensionPay charged on: on the tool's Import page, after Stripe's copy of your customers. Each keeps its price, renewal day and card; nothing is charged on the day, and nobody twice. See Move subscriptions from another Stripe account.
• The Toolaby popup and the paywall, in your brand and the buyer's language. See Toolaby popup.
• Hobby and Pro. Hobby is $0 and takes 0.5% of each sale. Pro is $25 a month or $240 a year and takes no fee. See Plans.
• Buyer pages in eight languages: sign-in, checkout and the account page. See Buyer pages.
• Webhooks and the API: six events and five endpoints. See Webhooks and API.
• The MCP server for coding agents: npx -y toolaby@latest mcp, and these docs at https://toolaby.app/api/mcp. See Build with an agent.