Mastodon 5.0.0-beta.1 moves sign-up into the OAuth flow and deprecates POST /api/v1/accounts

Announced4 Nov 2026

EffectiveNot stated

PlatformMastodon

What changed

Mastodon tagged v5.0.0-beta.1 on November 4, 2026. The 5.0.0 changelog adds sign-up through the OAuth flow and says the previous registration flow, POST /api/v1/accounts, is deprecated and will be removed in a future version, with no date. It also adds allow_nonfunctional to GET /api/v1/accounts/verify_credentials, changes authentication errors to HTTP 422 instead of 200 and makes empty search requests return HTTP 400. 5.0 final is not released yet.

What it means

Apps that create Mastodon accounts through POST /api/v1/accounts should move to the OAuth sign-up flow (prompt=create), and authentication errors now return HTTP 422 instead of HTTP 200.

Who is affected

Developers of Mastodon clients, onboarding flows and tools that sign users up or check tokens. mastodon.social already runs 5.0 nightly code.

What to do

Send new users to /oauth/authorize with prompt=create (and invite_code when following an invite). Stop relying on POST /api/v1/accounts, handle HTTP 422 on auth errors, and use allow_nonfunctional on verify_credentials for unconfirmed or unapproved accounts.

What this means for you

Some apps let you make a new Mastodon account without leaving the app. In the next big Mastodon version, that sign-up moves to the server's own sign-in page, the same one you already see when you connect an app. The old way still works for now but will be switched off later. Apps that sign people up need an update. Posting is not affected.

The details

Release: v5.0.0-beta.1 was tagged on November 4, 2026. The main CHANGELOG.md still lists ## [5.0.0] - UNRELEASED. On November 7, 2026, mastodon.social's /api/v2/instance reported version 5.0.0-nightly.2026-11-05.
OAuth sign-up: GET /oauth/authorize gains prompt (create enters the sign-up flow instead of log-in, login forces a fresh log-in) and invite_code (used with prompt=create, the last path segment of a /invite/:invite_code URL). mastodon.social's /.well-known/oauth-authorization-server lists prompt_values_supported: ["login", "create"].
Deprecated: POST /api/v1/accounts ("deprecated in favor of the OAuth sign-up flow"). The changelog says it "will be removed in a future version". No removal date is given.
New parameter: allow_nonfunctional on GET /api/v1/accounts/verify_credentials returns the account even if it is not yet confirmed or approved. Default false.
Behaviour changes: authentication errors return HTTP 422 instead of HTTP 200; empty search requests return HTTP 400; server-side filtering is added to the home feed endpoint.
Admins: Node.js 22 and Ruby 3.3 and 3.4 support are removed, and zero-downtime migrations from versions before 4.7 are no longer supported.
The October 19, 2026 blog post covers the new web interface; it lists no API changes.

What to do next

Business owners: Nothing. Connecting and posting through your tools works as before.
Marketers and agencies: Nothing, unless your tool creates Mastodon accounts for clients: ask when it moves to the new sign-up flow.
Developers: Add prompt=create sign-up, retire POST /api/v1/accounts, treat HTTP 422 as an auth error, and test against a 5.0 beta or mastodon.social now.

Follow new entries with the RSS feed. Each platform also has its own feed, for example X or Meta.