# Appwrite 2.7.0 — Release & Upgrade Intelligence
- **Product:** Appwrite (https://appwrite.io)
- **Version:** 2.7.0
- **Released:** Nov 03, 2026
- **Impact Score:** 5/10
- **Breaking Changes:** Not verified
- **Canonical Analysis:** https://changelogs.us/appwrite/updates/2.7.0/

## Executive Summary (TL;DR)
Appwrite 2.7.0. Source highlight: Appwrite 2.7.0 adds server key rotation, a way to sign out every user of a project, a realtime policy that keeps guests from subscribing, origin-bound `OTP-Token` headers on code emails, Gitea in the Console's Git connect flow, and per-connection limits for realtime and MQTT. It also carries the sec

## New Features
- The `transfers`, `monitors`, `monitorAlerts` and `reviews` collections, used by API features that have no self-hosted Console screen yet (#14722, #15079, #15216, #15038, #15044).
- **API keys**: a key that creates a migration now needs the write scope of every resource it imports, and a key that configures a function or site can only add scopes it holds itself.

## Bug Fixes
- **Console 1.2.138.** Besides the screens above: **Logs** on verified domains, so certificate renewal warnings can be read (#15015); a warning and Disconnect action when a site's or function's repository is no longer reachable through its installation (#15043); column editor fixes (#15081, #15117, #15072); API explorer keys kept in memory instead of `localStorage` and cleared on sign-out (#14994); and patched Zod copies (#14908).
- Require an MFA challenge from the last few minutes to turn MFA off, as deleting an authenticator already does (#15057).
- Make TOTP codes single-use, so one code can't complete a challenge on a second session; the enrolment code can't be reused either (#15154).
- Proving an unverified phone now claims the account the same way an unverified email does. Every claim path (magic URL, email OTP, password recovery, signed-out team invite) revokes what the registrant left behind, keeps MFA in force when the account needs two factors, and closes the registrant's live realtime and MQTT connections (#15058, #14976, #15144, #15062).
- Bind the OAuth2 state to the user who started the flow (#15029).
- Scope the email sign-in rate limit to the project and address (#15023).