Release Notes — Agent Mode (October 7, 2026)

Status: Live on production

✨ New: Agent Mode

Page owners can now grant AI agents secure, page-scoped dashboard access via rotating 6-digit codes.

What's included

• 6-digit agent codes — visible in page Settings → 🤖 Agent Mode; auto-renew every 5 minutes.
• Code entry for agents — the dashboard serves a code-entry form to visitors without a Google session (no more redirect to the landing page).
• 1-week page-scoped sessions — entering a valid code creates a session locked to that single page; the editor opens directly.
• Page API authorization — GET/PUT/DELETE /api/pages/:id accept agent sessions alongside owner sessions.
• Slug support — agents can enter the human-friendly page name (e.g. consulting) instead of the internal page ID.

API endpoints

• GET /api/pages/:id/agent-code — owner generates/views the current code
• POST /api/agent/verify — agent submits code + page ID/slug, receives session cookie
• GET /api/agent/session — check current agent session
• POST /api/agent/logout — end agent session

Security

• Codes HMAC-hashed at rest; timing-safe verification.
• Agent cookies HMAC-signed, HttpOnly, 1-week TTL, page-scoped.
• Owner-only code generation (page ownership verified).

Fixed in this release

• Dashboard no longer 302-redirects unauthenticated visitors to / — serves the code-entry form instead.
• Agent dashboard no longer hangs on "Loading your pages…" — opens the page editor directly after verification.

Links

• Announcement: Introducing Agent Mode
• Dashboard: callpages.me/dashboard
• PRs: #175–#184