This is the first installment of a monthly convention: once a month, this blog carries one post named Orbit release notes — <month> <year> covering what actually shipped that month. Each section names the capability, why it matters, and where to find it in the dashboard and the docs. Nothing below is promised future work — every item is live today.
MCP elicitation — sensitive tool input through a secure hosted page
What shipped — Orbit's MCP server, which lets AI clients such as Claude Desktop, Claude Code, and Cursor call tools against your account, now uses URL-mode elicitation for the tools that need a sensitive value to continue — a payment-mandate confirmation code, an authorization token from a connected provider, and similar one-time secrets. Instead of rendering a form in the chat window, the tool call returns a link to a secure, Orbit-hosted page. Each link is single-use and expires after 15 minutes.
Why it matters — Previously the sensitive value was typed into the client itself, which means the client (and anything logging its traffic) saw the plaintext secret. URL-mode elicitation moves the value out of the client entirely: the secret goes straight to Orbit and the link can't be replayed. Clients that don't support it yet are unaffected, and the existing confirmation prompts before a tool sends a message or deletes data stay exactly as they are.
Where to find it — The MCP connection guide in the docs walks through connecting a client. The changelog entry covers the URL-mode behavior: "Sensitive MCP tool input now goes through a secure hosted page, not the chat window."
Per-API-key usage budgets with spend alerts
What shipped — Each API key's analytics drawer now carries a monthly usage budget with spend alerts built in. Set a monthly request ceiling on a key and the dashboard shows the share consumed over the last 30 days as a progress bar, warns in amber once the key crosses 80% of the budget, and raises a red flag once the spend passes the ceiling — against the same per-key attribution the Developer → API analytics page already reports.
Why it matters — An integration that starts hammering the API used to blend into account-wide totals. A runaway retry loop or a leaked key now shows as a warning badge in the dashboard minutes after usage starts climbing, not on the invoice. Keys you haven't configured — and older clients that never set a budget — behave exactly as before until you set one.
Where to find it — Settings → API keys, expand a key's analytics row, and set the budget in the Usage budget section. A full walkthrough is in the per-key usage budget guide.
The 10DLC calculator — a free, public tool
What shipped — A standalone, public 10DLC calculator under /tools on the marketing site. It models the US carrier framework for application-to-person (A2P) SMS from standard 10-digit numbers — Brand and Campaign registration with The Campaign Registry (TCR), and the throughput carriers assign from the brand's vetting score.
Why it matters — 10DLC pricing and throughput are the two questions US A2P senders actually need answered before they register. The calculator is public, requires no sign-in, and sits on the marketing site so the answer is citable and shareable rather than gated behind a dashboard.
Where to find it — The tool hub at orbit.devotel.io/en/tools/10dlc-calculator. The SMS API capability page carries the SMS side of the story.
Video room embed — an Embed snippet dialog for integrators
What shipped — Video rooms now expose an Embed snippet dialog, so integrators can drop a working video consultation into a page without hand-writing the web-SDK call. The OrbitVideoRoom web-SDK surface and the prebuilt widget embed contract are documented in the docs.
Why it matters — The video API shipped earlier with per-user access tokens; the embed dialog closes the last-mile gap between "the API exists" and "an integrator has it in a page." The snippet carries the public contract, so an embed doesn't drift when the SDK internals move.
Where to find it — Open a video room in the dashboard and use the Embed dialog; the full walkthrough is in the embed video consultation button guide. The earlier video API embedded support guide covers the platform shape.
Agent ROI attribution — summary, trend, and config surfaces
What shipped — The Agent ROI surface — per-agent AI cost against the attributed revenue of resolved outcomes, with a daily trend and a pricing config — now ships with a full attribution guide in the docs.
Why it matters — Attribution numbers are only as meaningful as the assumptions behind them. The guide covers what ROI measures, the summary and trend surfaces, how the value-per-outcome config behaves as a read-merge-write with per-rubric overrides, and the role scope (owner, admin, developer, billing) that gates the numbers.
Where to find it — Guides → Agent ROI attribution in the docs; the prior blog installment Scoped agent credentials, pinned regression replay, and the Agent ROI guide covers the week's agent-facing updates around it.
---
The monthly convention
This post is the first installment of a recurring cadence, not a one-off. The convention for the editor's desk:
- Cadence and slug — one post per calendar month, named
Orbit release notes — <month> <year>, sluggedorbit-release-notes-<month>-2026(the year rolls forward each new year). - Tag rule — every installment carries the
release-notestag (withchangelogandproduct-update) so the class is machine-identifiable across the index and the structured data; no other post class uses it. - Structure — one section per shipped capability, each with the same three moves: what shipped, why it matters, where to find it (dashboard path plus a docs or blog link). Sections are written for a customer scanning "what changed and why it matters to me," not an internal release log.
- Honor shipped reality — release notes cover shipped capability only; nothing below is a roadmap promise. An item that ships mid-month waits for the next installment rather than arriving as vapor.
- Cross-link convention — each capability landing page (SMS API, WhatsApp Business API, voice AI agents) should link to the release-notes installment that announced it, and each installment links back to the capability page — so a reader landing on the product surface can trace the announcement, and a reader on the announcement can reach the product.
Next installment: September 2026.