Docsheaf
Sign inStart for free
Changelog

What’s new in Docsheaf

Every change that has shipped, newest first — including API changes integrators need to know about.

Feature

Integration apps

Build apps on the Docsheaf API that other organizations install with OAuth.

  • Register an app in Organization settings → Apps: redirect URIs, read or read-and-write access, and a webhook URL for the events it needs. Keep it private to your organization or make it public.
  • Admins install apps from the app’s site on a consent screen that shows who built it and what it can do, and choose the spaces it reaches.
  • Standard OAuth 2.0 with PKCE: an access token for an hour, refresh tokens that rotate, and revocation. The app acts with the installing admin’s access — at most like an editor — and shows in the audit log as “name via app”.
  • See, limit, reconnect or uninstall installed apps in Organization settings → Integrations.
Feature

Docsheaf Agent

An agent that drafts change requests for your docs, for your team to review.

  • Turn it on in Organization settings → Agent (Business and above), and choose its spaces, how often it runs and how many change requests it may draft a month.
  • Content gaps: for what readers searched for or asked Ask AI about and didn’t find, it drafts a page from what your pages already say — listing the pages it used — or drafts nothing when they don’t cover it.
  • Moved links: it points links at where renamed or moved pages are now.
  • Every draft is an ordinary change request: the space’s creators and admins are asked to review, merge rules apply, and the agent never merges. It shows up as the Docsheaf Agent in change requests, notifications and the audit log.
Feature

Adaptive content

Pages can now adapt to each reader, using details your product passes along — such as their plan or role.

  • Turn it on per site in Site settings → Customize → Adaptive content (Business and above).
  • Pass details in a link (?visitor.plan=pro, remembered while the reader browses) or in a docsheaf-visitor cookie with JSON.
  • Add “Conditional content” from the / menu: its blocks show only to readers whose details match a condition like visitor.claims.plan == "pro".
  • List a page only for some readers from its menu in the page tree; navigation, next-page links and search follow it.
  • llms.txt, Markdown versions and the sitemap show what a reader without details sees. The details aren’t verified, so adaptive content personalizes pages but doesn’t protect them.
SecurityFeature

Audit log streaming

Enterprise organizations can send their audit log to their SIEM as it happens.

  • Add a stream in Organization settings → Audit log: Splunk (HTTP Event Collector), Datadog Logs, an S3 bucket (or R2 and other S3-compatible storage), or any HTTPS endpoint.
  • Every event arrives a few seconds after it happens, in order. A destination that is down catches up when it answers again — nothing is skipped or sent twice.
  • Send a test event, pause and resume streams, and see the last delivery or error in the settings.
  • HTTPS streams are signed like webhooks. Credentials are stored encrypted and never shown again.
Feature

Slack notifications and GitHub commit statuses

Your docs’ activity can now reach Slack, and GitHub shows where a pushed change stands in review.

  • Connect Slack channels in Organization settings → Integrations, with “Add to Slack” or an incoming webhook URL.
  • Each channel chooses what it hears about — change requests opened or merged, reviews, comments, sites published — and from which spaces. Restricted spaces stay out unless you pick them.
  • Send a test message from the settings, which also show when the last message went out or why it didn’t.
  • When Git Sync opens a change request from a push, the pushed commit gets a “Docsheaf” status on GitHub: waiting for review, approved, changes requested, merged or closed. The GitHub App needs the Commit statuses permission.
SecurityFeature

Scoped API tokens

API tokens can now be limited to what an integration actually needs.

  • Make a token read-only: it can read everything you can, and change nothing.
  • Limit a token to one organization, or to a few spaces of it — it then sees only those spaces and can’t touch sites, members or settings.
  • Give a token an expiry date (30 days, 90 days or a year).
  • Account settings → API tokens shows what each token can reach. Existing tokens keep working as before.
Feature

MCP server for every docs site

AI agents in editors and chat apps can now search and read your published docs through the Model Context Protocol.

  • Turn it on per site in Site settings → Customize → MCP server (Business and above), then add the URL shown there — your site’s address followed by /mcp — as a remote MCP server in Claude, Cursor or another client that supports Streamable HTTP.
  • Three tools: search the docs, read any page as Markdown, and list every page by section.
  • Agents see what llms.txt shows: published sections, without hidden pages or pages marked noindex. An unlisted site’s server needs its share token.
  • llms.txt now names the server, and Insights counts the searches and page reads agents make.
FeatureSecurity

Teams and space permissions

Decide who opens each collection, docs site and space in the app, person by person or by team.

  • Admins group members into teams in Settings → Teams.
  • The new Share dialog on spaces, docs sites and collections gives a member or a team a role there — above or below their organization role — and shows everyone who can open it.
  • Restrict a collection, site or space to the people and teams you choose. Everyone else no longer sees it in the sidebar, search, change requests, notifications or previews; organization admins still open everything.
  • A role or restriction on a collection applies to its sites and their spaces, and one on a site to its spaces.
  • Every change is in the audit log. Teams and permissions are on the Business plan and above; removing access never needs a plan.

Feature

AI Assistant for readers

Readers can ask your docs a question and get a short answer written from your published pages, with links to every page it used.

  • Turn on “Ask AI” per site in Site settings → Customize (Pro and above). It adds a button to the header, and anything typed into ⌘K search can be asked in one click.
  • Answers stream into a side panel, come only from the published pages of the version or language the reader is on, and cite each page as a numbered link. When the docs don’t cover a question, the assistant says so.
  • Readers can ask follow-up questions and rate each answer helpful or not; the conversation stays open while they read the pages it cites.
  • Insights shows how many questions were answered from your pages and lists the ones that weren’t, or whose answers readers rated unhelpful.
  • Answers are written by Claude from Anthropic, now listed as a sub-processor. Questions are stored without IP addresses, and the assistant can ask for a captcha after a few questions.
Feature

Git Sync with GitHub

Keep a space in step with a folder of Markdown on a GitHub branch, in both directions.

  • Connect a space to a repository, branch and folder from its settings with the Docsheaf GitHub App, and choose which side the first sync starts from.
  • Merges, restores and live edits on the space become commits with the author’s name, written in GitBook’s layout (one .md per page, SUMMARY.md and assets).
  • Pushes come back as edits: applied directly when only Git changed, or as a change request when both sides changed or the space is locked, so conflicts are resolved like any other merge.
  • Sync status, “Sync now” and disconnecting are in the space settings. GitLab is still on the roadmap.
Security

Passkeys

Sign in with a passkey, or use one as your second step instead of an authenticator code.

  • Add, rename and remove passkeys in Account → Security; each change sends a security email and appears in your security log.
  • “Sign in with a passkey” on the login page signs you in without a password.
  • A passkey counts as two-factor authentication, including for organizations that require it. Your first passkey or authenticator app comes with recovery codes.
Feature

Versions, languages, section groups and collections

Publish several versions or languages of a section side by side, group header tabs, and file docs sites into collections.

  • A section can hold variants — versions like v2 and v1, or languages like English and Français (Pro and above). The default is served at the section’s URL, the others under their own slug.
  • Readers switch variants from the header or above the table of contents and stay on the same page when it exists in the other variant; search covers the variant they’re reading.
  • Readers who picked a version or language are taken back to it when they open a page of the default one, with a note to switch back. Drag variants into the order the switcher shows.
  • Language variants get hreflang alternates in page metadata and sitemap.xml, llms.txt lists every variant, and Insights breaks views down by variant.
  • Sections with the same group label share one dropdown in the published header.
  • Collections are folders for docs sites in the sidebar and on the home page: drag a site onto one to file it there.
Feature

Cards, columns, math, Mermaid and OpenAPI blocks

Five new blocks for the editor and published sites, all round-tripping through GitBook-style Markdown.

  • Cards: a grid of link cards with a title, description and optional cover image.
  • Columns: two or three side-by-side columns with optional widths, stacked on small screens.
  • Math: display and inline equations in TeX, rendered with KaTeX.
  • Mermaid: code blocks in the Mermaid language are drawn as diagrams, with a live preview while editing.
  • OpenAPI reference: point at an OpenAPI 3 spec (a URL or an uploaded file) and show all of its operations, one path or a single operation, with parameters, request and response schemas and examples. Specs are refreshed every few hours.
Feature

Inline comments

Comment on a specific passage of a page instead of the page as a whole.

  • Select text and choose Comment in the toolbar (or press ⌘⌥M); the thread opens in the comments panel with the passage quoted.
  • Commented text is highlighted in the editor: click it to open its thread, or click a thread’s quote to jump to the text.
  • Commenters can comment from a read-only page. Comments never appear on published sites or in Markdown, and they don’t count as changes in change requests.
Security

Share links required on every page of unlisted sites

Opening a share link no longer unlocks the bare site address in that browser.

  • Every link on an unlisted site carries its share token, including search results, “View as Markdown” and the links in llms.txt.
  • A URL without the token shows a “Share link required” screen, and an old or regenerated token says the share link no longer works.

Feature

Restore, review requests, page comments, notifications, redirects and webhooks

A round of everyday tools for teams: undo with history and trash, ask for reviews and get told about them, discuss pages, keep old links working, and connect your own services.

  • Restore a whole space or a single page from history; in locked spaces the restore opens a change request.
  • Deleted spaces wait in Trash, in the sidebar, until you restore them or delete them for good.
  • Ask teammates to review a change request. They are notified in the app (the bell) and by email, and so are authors when their change request is reviewed or merged.
  • Comment threads on any page, with replies, @mentions, emoji reactions and resolving. Choose which activity is emailed to you under Account → Notifications.
  • Renamed and moved pages redirect from their old URLs automatically; custom redirects are in Site settings → Redirects.
  • Duplicate pages and spaces. Pages can have a cover image and can be kept out of search engines, the sitemap and llms.txt.
  • File blocks for downloads, line numbers and wrapping for code blocks, theme presets, code themes, link styles and per-section themes.
  • Signed webhooks for change requests, reviews, comments, content and publishing, with delivery history and retries.
  • Deleted pages can always be restored, from Deleted pages under the page tree — even ones removed by a merge.
  • Links to a renamed section, or to a section that is no longer the home, redirect on their own.
  • Insights lists broken links: missing pages, headings and files, and external links that are gone.
  • Export a space as Markdown (a .zip in GitBook’s layout, with its images), and import Word and HTML files as pages.
  • Comments can be edited, mentions work in reviews, and the notification bell updates live.

Feature

Docs sites own their spaces

Every space now belongs to exactly one docs site. A site’s published sections — the tabs in its header — are simply its spaces in order, and the first one is the home.

  • A new site is created together with its first space.
  • Site settings has a Spaces tab: create, rename, change a space’s URL, reorder, move a space to another site, or delete it.
  • The sidebar nests spaces under their site, and the organization home shows a panel per site.
  • Existing published sites keep their URLs: each space takes over its section’s title and slug.
  • Deleting a site moves its spaces to the trash, and moving a space is recorded in the audit log.

Breaking API change

POST /orgs/:orgId/spaces and the /sites/:siteId/sections routes are removed. Create spaces with POST /sites/:siteId/spaces, set their URL with PATCH /spaces/:id { slug } and reorder them with POST /spaces/:id/move. Site responses return `spaces` instead of `sections`.

Security

Sign-up with an emailed verification code

New accounts confirm their email with a 6-digit code before anything is created, so every account starts out verified.

  • No user, organization or session exists until the code is confirmed.
  • Codes expire after 10 minutes and allow 5 attempts; requesting a new code invalidates the previous one.
  • Only hashes of the code are stored, so a database read can’t recover it.
  • The sign-up form gained a “Check your email” step with resend and “Change email”.

Breaking API change

POST /auth/signup now returns 202 { challenge, email, expiresInMinutes } without a session. Call POST /auth/signup/verify to create the account and sign in.

Infrastructure

S3 and Cloudflare R2 storage for uploads

Images and avatars can now be stored in an S3-compatible bucket — AWS S3, Cloudflare R2 or MinIO — instead of local disk.

  • Choose the driver with STORAGE_DRIVER; configuration is checked at start-up.
  • Files are served through Docsheaf by default, or redirected to a CDN or R2 custom domain with FILES_PUBLIC_URL.
  • Objects are stored with their content type and immutable caching; file names never decide the extension.
SecurityFeature

Account security, email and audit logs

A full account-security layer, with designed transactional emails delivered over SMTP.

  • Ten branded email templates: welcome, verification, password reset and change, email change, two-factor on/off, new sign-in alerts and invites.
  • Two-factor authentication with authenticator apps and 10 recovery codes, plus an organization setting that requires it.
  • Forgot and reset password, change password, and change email with confirmation.
  • Sign-in lockout after repeated failures, new-device alerts, and a list of active sessions you can sign out remotely.
  • A personal security log and an organization audit log with filters, CSV export and configurable retention.
  • Invites can now be sent by email.
  • Account settings for profile, security, sessions, activity and API tokens.

Launch

Docsheaf launches

The first release of Docsheaf: write, review and publish documentation.

  • Organizations with six roles, invites and personal API tokens.
  • A block editor with hints, tabs, steppers, expandable sections, code, tables, images and embeds.
  • Content-addressed documents, revisions, and change requests with reviews, comments, merge rules and block-level three-way merge.
  • Docs sites with theme customization, ⌘K search, outline, page feedback and dark mode, on a path, subdomain or custom domain.
  • A Markdown version of every page, plus llms.txt, llms-full.txt and sitemap.xml.
  • Insights: page views, visitors, feedback, searches and searches with no results.
  • Markdown import with GitBook-style blocks, and a REST API described with OpenAPI.

Try what’s new

Start for free, or sign in with the demo account to explore a fully seeded workspace.

Start for freeTalk to us