---
title: "Version 1.3.0 - Custom Fields in Auto-Responders"
description: "Custom field tokens in auto-responder emails plus a REST endpoint to set order custom fields post-purchase"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.sparkcrm.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Version 1.3.0 - Custom Fields in Auto-Responders

Released on July 13, 2026

This release lets merchants surface arbitrary order data in their transactional emails and gives integrations a supported way to attach that data after a purchase. The motivating use case is license-key delivery: a plugin generates a key after checkout, writes it to the order, and the confirmation email includes it automatically.

## Highlights

### Custom Field Email Tokens
Auto-responder templates (order confirmation, subscription renewals, and every other trigger) now support dynamic tokens sourced from custom fields, using the same dot-notation convention as webhooks:

```
{custom_fields.license_key}
{custom_fields.your_key}
```

Values come from the order's (or subscription's) `custom_fields`. Any token whose key is not present on the record is removed from the rendered email, so customers never see an unresolved placeholder.

### Set Order Custom Fields via REST
A new endpoint merges custom fields onto an existing order, so integrations can write values that are only known after the purchase completes:

```bash
PATCH /v1/orders/{order_number}/custom-fields
Content-Type: application/json

{ "custom_fields": { "license_key": "VS-9F2A-7K3D-2026" } }
```

- Requires the `api:orders.update` ability (legacy `api:update` also accepted).
- Merge semantics: incoming keys overwrite existing ones; untouched keys are preserved.
- Field rules: up to 50 keys, keys of 1–64 characters (`a-z`, `A-Z`, `0-9`, `_`, `-`), string values up to 1000 characters.

Recommended flow for post-purchase data (e.g. license keys): write the value with this endpoint, reference it in the confirmation template as `{custom_fields.<key>}`, and use the auto-responder's delay to give the integration a window to write the value before the email fires.

### Safer Email Rendering
Custom field values are HTML-escaped at the email boundary before substitution, so values written through the API cannot inject markup (phishing links, tracking pixels) into a merchant's branded transactional emails.

## Breaking Changes

None - this release is fully backward compatible. No migrations required.

## Upgrade Guide

```bash
composer update
php artisan cache:clear
```

No database or configuration changes are needed. The `api:orders.update` ability already exists in the API permission catalog; grant it to any token that needs to write custom fields.

## What's Next

Optional discoverability for custom field tokens directly inside the email template editor.

Source: https://docs.sparkcrm.io/changelog/v1.3.0/index.mdx