Hello, and welcome to the October edition of the Rebilly news, features, and updates blog.

We added the option to retain a recurring order in the sandbox environment. Recurring orders in the sandbox environment are canceled 90 days after they are created, unless you retain the order. For more information, see Sandbox recurring order retention.

Order item changes apply at the next renewal. The current items are not replaced until the renewal, and they continue to be billed until then. The new items are billed on the next renewal invoice. For more information, see Modify subscription items or settings.

Webhooks are sent when an order change is created, applied, or canceled. For more information, see Order change created, Order change applied, and Order change canceled.

Unpaid renewal invoices trigger past due reminders for 15, 30, 60, and 90 days after the due date. For more information, see Invoice past due reminders.

You choose a confirmed match or a false positive for each Anti-Money Laundering (AML) hit. An AML check can return more than one hit. Each hit is one record from an AML list. The check status is calculated from those decisions. For more information, see Review AML hits.

Organizations can require multi-factor authentication (MFA) for all users. A user without MFA must set it up before using that organization. API keys are not affected. Live and sandbox are configured separately. For more information, see Require MFA for your organization.

Face proof images have a minimum brightness setting. The default minimum is 40 on a scale from 0 to 100. A face proof image below the minimum fails the check. For more information, see Configure face proof brightness.

API keys now have an expiration date. From the expiration date, a request that uses the API key is not authorized. An API key without an expiration date does not expire. For more information, see Set or remove an expiration date.

Each API key displays the time and IP address of the most recent request that used it. Use the time and IP address to find keys that are no longer used, or keys that are used from an unexpected IP address. Requests are recorded from October 28, 2026. For more information, see Check when an API key was last used.

The full secret key is displayed only when you create it. After that, the key is masked and cannot be displayed again. For more information, see Obtain a secret key.

Allowed IP addresses restrict where a secret API key can be used. A secret key with no allowed IP addresses can be used from any IP address. After you save allowed IP addresses, requests from other IP addresses are not authorized. For more information, see Limit where a secret key can be used.

Permissions for a user, a role, or an API key are set from a pasted list of operation IDs. Permissions that are not in the pasted list are removed. For more information, see Add a new user, Create roles, and Create an API key.

Apple Pay domains are now registered automatically, and you can add or remove them. A domain is registered the first time a customer pays with Apple Pay on it, when the verification file is on the domain. An organization can have up to 99 Apple Pay domains in each environment. For more information, see Manage Apple Pay domains.

The Google Pay and PayPal elements in FramePay now emit ready and error events. The ready event is emitted when the button is displayed. The error event is emitted when a mounted button is not displayed. For more information, see Element events.

Batch actions move payout requests to another batch, block or unblock selected requests, and edit the batch name and description. For more information, see Manage batches.

Webhooks are sent when a payout request changes and when a payout request batch is created, modified, or deleted. For more information, see Payout request changed, Payout request batch created, Payout request batch modified, and Payout request batch deleted.

Payout exposure previously included approved payments with no time limit and did not subtract refunds or voids. It now uses the last 180 days and subtracts approved refunds, voids, and payouts. For more information, see Allocate funds.

A credit memo can be linked to a transaction when it is created. The credit memo currency changes to the transaction currency. The credit memo items are replaced with one item for the transaction amount. For more information, see Create a credit memo.

• Added support for the Thunes Checkout payment method for the Thunes payment gateway.
• Added support for the Payment card payment method for the Cps payment gateway.

Rebilly supports 214 payment gateways and 184 payment methods including ACH, PayPal, and Bitcoin. If you would like to add a payment integration that's not in our list, complete the request a new payment gateway integration process. If you have any questions, please contact us. We are happy to help!

For more release information, see Release notes.

Not a Rebilly user? Sign up for a free trial and see what you're missing.