Changelog
SEPTEMBER 27, 2026
Plan your request budget
The rate-limit guide lists per-player, project, developer and shared-network budgets, explains 429 retries and includes a polling-capacity example. The console links to it next to project settings. These docs describe existing limits; no quotas changed.
SEPTEMBER 26, 2026
Visitors arrive without an extra wait
Wrapped bumps stay hidden. The updated weBump app releases a visitor after its normal unwrap (free, ad, timer or supporter); zero-delay profiles then have no extra API wait. Older app builds keep a conservative two-hour wait. Custom profile delays remain respected. New bump epochs refresh visitor eligibility inside the eight-hour reward window, and reconnecting no longer suppresses the card. The updated app retries verifiable recent local history on connection, foreground and network recovery. Older history cannot bypass rolling-ID expiry.
The racing demo counts unique opponents, refreshes its lobby every ten seconds, avoids overlapping refreshes and honors rate-limit backoff. A visitor without an eligible shared publication still races as AI.
SEPTEMBER 26, 2026
Reliable shared data and profile stats
Reconnecting with the same live permissions now rotates credentials without clearing shared data when the player continues sharing. Updating an unexpired publication preserves access for eligible visitors; opt-out, withdrawal, expiry gaps and explicit disconnect still end access. The racing demo uploads new best replays automatically, restores cloud recordings and reports profile-stat upload errors. Declare capsule and showcase fields as well as scopes to publish profile stats.
SEPTEMBER 20, 2026
Recognize returning visitors
Visitor cards now include visitor_id, an opaque recognition ID scoped to the game and receiving player. Repeated receipts share an ID while they remain unexpired, even after a name/color change. Different people with identical profiles stay separate. Privacy withdrawal and expiry gaps reset recognition; existing references and consent checks still authorize every read.
SEPTEMBER 20, 2026
Build with the Racing Demo
A seven-part tutorial now follows the demo from a local mock race to project approval, connection, private saves, visitors and selected shared data. Each lesson links to the source and includes a checkpoint. A downloadable static host bundles the browser SDK and generic “Go back to your game” callback prompt.
SEPTEMBER 20, 2026
Simpler browser connections
The JavaScript SDK adds connectBrowser: one call selects same-phone callback approval or computer-to-phone device approval, and handles PKCE, callback delivery, polling and cancellation. attachGameFrame supports embedded exports with a pinned host/frame bridge. The hosted Racing Demo now uses callback approval on iPhone/iPad without a matching code; computer approval keeps its QR and matching code.
SEPTEMBER 19, 2026
Explicit device connections and protected redirect delivery
Projects now request reviewed redirect and/or device connection methods. Device grants use a separate private polling credential and a matching code explicitly confirmed in weBump. Redirect polling is status-only and never returns a callback or authorization code. The JavaScript helper, Swift SDK, application form and approval UI support the new contract. Device connections require the updated weBump app.
The tutorial now explains the public-client security model: copied configuration alone grants no player access, callbacks protect authorization delivery, and player tokens authorize later requests. Same-device callbacks need no matching code; cross-device approval remains available. The JavaScript helper adds a same-origin browser callback relay, including new-tab returns, without a developer backend.
Connection security explained → · Integrate either method on any platform →
SEPTEMBER 16, 2026
Approve from any device (superseded)
The September 19 device grant replaces the former callback-polling mechanism described below. Do not implement the older polling contract.
This release introduced QR approval across devices using callback polling. That delivery mechanism and its beginScannableConnection SDK method have been removed. Use the reviewed device grant and its independent private polling credential; redirect status polling never carries credentials.
SEPTEMBER 18, 2026
Automated icon screening
Game icons are now screened for harmful content the moment they are submitted, before anyone reviews the application. A rejected icon is never stored or published and returns icon_rejected; if the check cannot run, submission returns icon_review_unavailable rather than storing an unscreened image. Editing other fields does not re-screen an unchanged icon.
SEPTEMBER 15, 2026
Change requests, automatic visitors and browser clients
The callback-polling behavior in this historical entry was removed on September 19; use the explicit device grant for phone approval.
Approved projects can request permission and data-definition changes from the console. The maintainer applies or declines them, both sides are emailed, and the console shows the status and review note. Players keep their current permissions until they reconnect.
GET /v1/me/visitors lists a player's eligible visitors without a handoff: everyone they bumped since connecting, after the reveal delay. Reconnecting no longer drops a player's bumps. The handoff endpoint stays for explicit transfers.
The API added CORS for browser token, revocation and scoped API requests, allowing web exports to keep tokens in memory. CORS enables browser access; it is not client authentication. The callback-polling shortcut introduced in this release was removed on September 19. Use registered callback delivery with PKCE or the separately reviewed device grant. A missing publish flag on PUT /v1/me/shared returns 400 publish_required. Reviewed permission and data-definition changes for approved projects are applied by the maintainer on request.
SEPTEMBER 14, 2026
Selected shared game data
New game.shared permission and endpoints support reviewed, developer-defined nested JSON through authorized visitor references. Separate player opt-in, conditional writes, seven-day expiry and withdrawal keep private saves separate. Payloads stay out of weBump profile cards. Requires project review and the updated consent-capable weBump app.
SEPTEMBER 13, 2026
Connection controls and clearer applications
Official HTML/CSS and SwiftUI connect buttons with the app icon and connected state, plus standalone SVG artwork. Applications explain every permission and callback DNS requirements before submission. The web tutorial adds Godot export, popup and callback-cookie guidance.
SEPTEMBER 13, 2026
Edit applications before approval
Update a pending application or revise and resubmit a declined one. Keep your existing icon or replace it. Callback changes require new domain verification; approved applications remain locked.
SEPTEMBER 12, 2026 · PLATFORM PREVIEW
Games on profiles
Dynamic reviewed game icons, titles, links and public fields. Players choose per-game profile visibility; private saves remain separate.
Build and operate
Interactive synthetic API reference, web integration tutorial, Connect button kit, export workflow, project controls, usage measurements and independent status monitoring.
Preview API changes are tracked here. Breaking API changes will use a new version or an announced migration window; this page does not override existing developer agreements.
SEPTEMBER 10, 2026
Developer preview opens
Verified applications, automatic provisioning, OAuth/PKCE, game-defined JSON state, capsules, showcases and local-history visitor handoff.