If you experience this error when logging into Alloy Mobile, please update the app to the latest version (v2.66). The error is caused by a recent improvement to Alloy's authentication service to make it more secure.
Welcome back! 👋 It's going to be a pivotal year for Alloy, with some truly groundbreaking new experiences and features heading your way very soon! In the meantime, there have been some significant changes in this month's release, along with the usual assortment of fixes and improvements.
The update took place during the evening of the 9th January. For a full list of changes in v2.66, please visit the Alloy Changelog.
We've introduced the concept of standard paths to the Pathfinder. These are predefined shortcuts to attributes on connected designs or interfaces.
The Pathfinder lets you browse and select the attributes of a design/interface, plus the attributes of any others that are connected to it via a Link attribute. You can follow a Link attribute to visit a child design/interface, or navigate to a parent design/interface that links to the current one. You can repeat this in either direction for any number of "hops", enabling you to select attributes across multiple designs/interfaces where a path exists between them.
A standard path provides a handy shortcut to a connected attribute. Selecting it adds the attribute to your query in one go, saving you the time and effort of navigating to the relevant design/interface (potentially over many hops). Not only does this bring the connected attribute within easy reach, it also surfaces the attribute to users that may be unaware of its availability!
Standard paths can be defined on individual designs or interfaces. Currently, this can only be done via the API using the Design and DesignInterface endpoints (see Swagger or ReDoc).
However, it will soon be possible to define your own standard paths, as part of a whole new way of accessing Alloy! Stay tuned… 😉
Item forms let you customise the visibility and order of attributes when creating/editing items of a particular design.
On a Link attribute control, it's possible to set a query that filters and sorts the linked items stored in the attribute. This provides a way to customise the lookup list shown to users when they select that control on the form.
For example, it can be used to limit the available choices for the Status Link attribute on task items.
This functionality is now available on Alloy Mobile on iOS and will be available on Android next month. When creating/editing an item of a design with an item form, if you select a Link attribute control that has a query set, the contents of the lookup list will now be filtered accordingly on Alloy Mobile.
Please note that item form expressions are not yet available on Alloy Mobile and will go unprocessed if present. Additionally, some of the less common control types don't currently display on Alloy Mobile. To see which are compatible, see Item form controls in Alloy Help.
As previously announced, we can confirm that Alloy's API authentication has now been updated to only accept bearer tokens for enhanced security. Therefore, any tools or implementations that still supply tokens as headers or URL parameters will no longer be able to authenticate. If this causes any problems for you, please reach out to our Support team for assistance.
Congratulations for making it to the finish line of 2024! 🏁
It's been a more conservative year for Alloy, with a focus on behind-the-scenes improvements to Alloy's engine. While not too exciting, this has resulted in increased performance and reliability that everyone can benefit from.
In particular, Alloy Mobile iOS has seen numerous changes in the second half of the year, as part of a concentrated effort to significantly improve the user experience.
With that said, there have still been plenty of new features this year:
Alongside all this, work has continued throughout the year on an exciting project that we've hinted at a few times. It's taken a bit longer than we first anticipated – doesn't it always? – but as it represents the future of Alloy, we wanted to give it sufficient time to grow and evolve beyond our initial plans.
Fortunately, we're getting close to the point where we can finally reveal what we've been working on. Please bear with us a little longer, the Alloy revolution is almost here! ⚡
On behalf of the Alloy team, thank you for being with us in 2024. Enjoy the winter holidays and see you all in January! 👋
As we reach the end of 2024, there's a few things we want to let you know about before the holidays start.
Back in July, we announced that Alloy's API authentication will only accept bearer tokens starting from next year. Therefore, this is one last reminder that token headers and token URL parameters will no longer work as of early January 2025.
If you haven't already, please update any integrations or tools you use accordingly!
As part of some new year housekeeping, we'll be transferring ownership of the Alloy Mobile app to new Causeway developer accounts on both the App Store and Google Play Store.
Don't worry, this won't affect Alloy Mobile's availability on either store! You won't need to reinstall the app and any unsynced data should be unaffected.
However, there may be some minor side effects:
The developer transfer will be performed in January 2025. In the unlikely event that this causes any issues, please contact Support for assistance.
We will be improving the behaviour of the map in Alloy Mobile iOS:
Nothing too drastic but just so you know what to expect! These changes will be implemented in Alloy Mobile v2.66 on 9th January 2025. If you experience any issues with the new behaviour, please contact Support.
This month, we've been on a bug fixing mission 🐛. A plethora of issues have been identified and addressed to improve your overall Alloy experience.
For example: the Turn off all layers button no longer hides route geometry, NSG/NLPG imports can now be cloned successfully, and it's no longer possible to (eventually) scroll to a negative year in the calendar picker!
The update took place during the evening of the 28th November. For a full list of changes in v2.65, please visit the Alloy Changelog.
Expressions make your item forms dynamic and responsive to user input. Each control on the item form has properties such as Required, Read-only and Hidden. By targeting the output of an expression, these can change depending on the current state of the form.
You can build an expression by adding nodes and joining their inputs and outputs together. The Is Null conditional node outputs true or false depending on whether its input is empty or not. It's commonly joined onto a global node that fetches the value of an attribute control on the form.
Previously, the Is Null node didn't work with Alloy ID Array inputs. It therefore wasn't possible to check the contents of a Link attribute on the item being created/edited.
This has been now remedied, so you can build expressions like the one below, which fetches the value of the item's Defects attribute, checks it and outputs the result. This could be used to control the visibility of an attribute control that's only relevant for items with defects.
Please note: item form expressions aren't currently supported on Alloy Mobile. To learn more about them, check out Alloy Help.
We hope you like the new look of the Alloy Announcements page! 🎨
It's been a month of modest improvements to Alloy. No ground-breaking new features, just quiet optimisations and bug fixes to make your Alloy experience even better ✅. The update took place during the evening of the 31st October. For a full list of changes in v2.64, please visit the Alloy Changelog.
When uploading files to Alloy, they can now be scanned for malware.
Given Alloy's role in storing and processing lots of potentially sensitive data, we've always taken security very seriously. As a result, the attack surface of Alloy itself is fairly low, with no significant vulnerabilities detected during our annual third-party security tests. As a precaution, Alloy blocks the same file extensions as Microsoft Outlook by default, to prevent the storage of dangerous file types with well-known vulnerabilities.
However, it remains possible for a file containing malicious code to be uploaded and stored in Alloy. While it would effectively be dormant and unlikely to cause direct harm, bad actors could potentially utilise Alloy as a method of distribution for infected files (e.g. sent via workflow emails).
Therefore, files uploaded to Alloy can now be scanned using Amazon's GuardDuty Malware Protection. All files are quarantined by default until they pass the security checks. If malicious code is detected in a file, it remains inaccessible and can't be used for any purpose. Attempting to download it will display an error message, explaining why and recommending deletion.
If you wish to enable this extra layer of security on your customer project, please contact Support to opt in.
Most of this month's improvements are behind the scenes 🛠️. While there aren't any visible changes or new features to speak of, there have been significant improvements to Alloy's underlying engine.
In particular, Alloy's Task Executor has been worked on for over three weeks! The Task Executor monitors and juggles all the queued tasks (e.g. workflows, imports, bulk actions) to ensure they're performed efficiently, and that problematic tasks don't bring things to a standstill.
With more people using Alloy than ever before, the number and size of tasks has grown considerably, especially during peak times! 🥵
Therefore, the Task Executor has been upgraded to dynamically scale itself up and down in response to the current workload. Extra workers can be made available when things get busy. When things quieten down, workers can be shut down gracefully without interrupting any tasks in progress.
Bottom line: you should see increased reliability and performance in Alloy going forward!
The update took place during the evening of the 26th September. For a full list of changes in v2.63, please visit the Alloy Changelog.
This month, we’ve added a couple of handy new features and continued to focus on boosting the reliability of Alloy Mobile iOS 📱.
The update took place during the evening of the 29th August. For a full list of changes in v2.62, please visit the Alloy Changelog.
When building a workflow, the Http Request action lets you send a web request to a specific URL. The method, URL, body and headers can be configured with static values or populated dynamically (based on the output of other actions in the workflow).
If a request requires authentication details or other sensitive data, this can now be stored securely within a Text attribute on an item of any design. To make the attribute secure, it must be configured with a custom tag named Secret. When the attribute is populated on an item, the value will now be saved as an encrypted text string. The original text won't be viewable to anyone!
To reference a secret in a Http Request action, enter a dollar sign $ plus the attribute’s code when configuring the relevant property. The item containing the desired value must also be added to the action’s Key Items.
In the example below, $attributes_credentialsPassword_66ceecb95527bff1c0a108c8 is included in the action’s Url and Http Headers properties. The decrypted value will be used in the request:
GET /test?pass=mypassword1234 HTTP/1.1
Host: alloytest.requestcatcher.com
Authorization: Bearer mypassword1234
Connection: Keep-Alive
To import data using Gateway, you need to create and configure an import item, validate its configuration, and then commit its data to Alloy.
If an import item’s Status is Validated or Processed, you now have the ability to clone it! When cloning an import, you can view the existing configuration and make changes to any step, or just create an exact duplicate.
This provides a handy way to redo a committed import (possibly with different data files), or experiment with alternative import configurations, without having to configure a new import from scratch.
To clone the current import item, select More in the action bar and choose Clone import.
Item forms let you customise the order and appearance of attributes when users create or edit items of a particular design/interface.
In Alloy Mobile, item forms were previously loaded on demand. While this ensured they were up-to-date, they would unfortunately be skipped if your device happened to be offline at that precise moment.
Therefore, item forms are now downloaded when the app synchronises, and will be displayed regardless of your device’s connectivity.
To interact with Alloy’s API, you must include your personal API key in every request you send. Currently, there are three possible methods for doing this. However, two of these methods can potentially expose your API key to attackers.
Therefore, we’re announcing the deprecation of these insecure methods, which will be blocked entirely from January 2025.
Going forward, please use the bearer authentication scheme to communicate with Alloy.
All users and implementations that don’t use Bearer authentication to access the Alloy API.
The following authentication methods are now deprecated. They continue to work for now, but will no longer be accepted in the near future:
https://uk.alloyapp.io/api/session/me?token={value}
Token: {value}From now on, the only supported method is to use the Authorization header with the bearer scheme (RFC 6750):Authorization: Bearer {token}
January 2025
This month brings an assortment of behind-the-scenes improvements and fixes. Whilst these won’t be directly noticeable, you should find that various Alloy features are operating more robustly than before.
In particular, we’ve been focusing our efforts on Alloy Mobile, resulting in wide range of issues being identified and fixed (some of which were released as v2.60.1 and v2.60.2).
We’re also continuing to lay the foundations for the exciting new changes coming later this year 😎.
The update took place during the evening of the 25th July. For a full list of changes in v2.61, please visit the Alloy Changelog.