Version 1.3.0 - Custom Fields in Auto-Responders

Released on July 13, 2026

This release lets merchants surface arbitrary order data in their transactional emails and gives integrations a supported way to attach that data after a purchase. The motivating use case is license-key delivery: a plugin generates a key after checkout, writes it to the order, and the confirmation email includes it automatically.

Highlights

Custom Field Email Tokens

Auto-responder templates (order confirmation, subscription renewals, and every other trigger) now support dynamic tokens sourced from custom fields, using the same dot-notation convention as webhooks:

{custom_fields.license_key}
{custom_fields.your_key}

Values come from the order’s (or subscription’s) custom_fields. Any token whose key is not present on the record is removed from the rendered email, so customers never see an unresolved placeholder.

Set Order Custom Fields via REST

A new endpoint merges custom fields onto an existing order, so integrations can write values that are only known after the purchase completes:

PATCH /v1/orders/{order_number}/custom-fields
Content-Type: application/json

{ "custom_fields": { "license_key": "VS-9F2A-7K3D-2026" } }

• Requires the api:orders.update ability (legacy api:update also accepted).
• Merge semantics: incoming keys overwrite existing ones; untouched keys are preserved.
• Field rules: up to 50 keys, keys of 1–64 characters (a-z, A-Z, 0-9, _, -), string values up to 1000 characters.

Recommended flow for post-purchase data (e.g. license keys): write the value with this endpoint, reference it in the confirmation template as {custom_fields.<key>}, and use the auto-responder’s delay to give the integration a window to write the value before the email fires.

Safer Email Rendering

Custom field values are HTML-escaped at the email boundary before substitution, so values written through the API cannot inject markup (phishing links, tracking pixels) into a merchant’s branded transactional emails.

Breaking Changes

None - this release is fully backward compatible. No migrations required.

Upgrade Guide

composer update
php artisan cache:clear

No database or configuration changes are needed. The api:orders.update ability already exists in the API permission catalog; grant it to any token that needs to write custom fields.

What’s Next

Optional discoverability for custom field tokens directly inside the email template editor.