Source: https://gameye.com/blog/gameye-platform-update-september-2026/

---
title: "Gameye Platform Update September 2026 — Session API v1.2.1 | Gameye"
description: "September 2026 Gameye platform update: Session API v1.2.1 with scoped tokens, session filtering, and application management via API."
---

# Gameye Platform Update — September 2026

Session API v1.2.1 expands the public surface with scoped token delegation, backfill filtering, and full application management via API.

[Bogdan Galatanu](https://gameye.com/blog/author/bogdan-galatanu/)
_Engineering Manager at Gameye_

Sep 29, 2026

September brought a major expansion to the public API surface. Session API v1.2.1 lands with scoped token delegation, session filtering for backfill, live log access, artifact retrieval, and full application management via API — replacing the previous requirement to use the admin panel for many of those operations.

Here’s everything that landed.

## Session API v1.2.1

The original API surface was deliberately minimal — start a session, stop it, check available locations. That’s enough to get a game running, but not enough to build a production backend on. v1.2.1 closes most of the remaining gaps.

### Scoped token delegation — `POST /token`

API tokens can now issue scoped sub-tokens at runtime. You pass your master token, a list of scopes, and an expiry duration; you get back a token that can only do what you asked for, and only inherits scopes your calling token already holds — no escalation possible.

This matters for any multi-component architecture. Your matchmaker holds a long-lived token with broad scopes; your game client gets a short-lived `session:read`-only token good for 10 minutes so it can poll state without touching anything destructive. Your CI pipeline gets an `application:write` token scoped to the deploy job, which expires when the job finishes.

Available scopes include `session:start`, `session:stop`, `session:read`, `logs:read`, `artifact:read`, `application:read`, `application:write`, and `token:write`.

### Session filtering — `GET /session`

The list endpoint now accepts query parameters. The most operationally significant are the `playerCount` filters, which exist specifically to support backfill:

```
GET /session?location=europe&image=my-game&playerCount[lt]=8
```

Returns every session in Europe with fewer than 8 players — enough to route new players into existing lobbies rather than always starting cold. You can also filter by location, image, tag, host IP, and arbitrary label key/value pairs set at session start time.

### Application management via API

Creating and updating application registrations — the configuration that maps a Docker image to its resource limits, region availability, and port bindings — previously required the admin panel. Five new endpoints change that: `POST /application`, `PUT /application/{name}`, `GET /application`, `POST /application/{name}/tags`, and `GET /application/{name}/tags/available`.

The most useful of these for teams with any kind of CI/CD pipeline is `POST /application/{name}/tags`: call it after a successful image push to pre-load the new tag across the Gameye fleet. By the time QA finishes, the image is already distributed and the first session starts without a cold-pull delay.

### Other additions

`GET /session/{id}` returns full session state including current container status (`running`, `draining`, `server_unreachable`, etc.) and the tracked player list — useful for health checks and session watchdog logic.

`GET /region` returns the complete list of region names available to your account, so you can drive region selection dynamically rather than hardcoding strings.

`POST /session` gets two corrections: `ttl` is a duration string (`"2h"`, `"30m"`) not an integer, and `external_id` is now documented — it lets you attach your own identifier (match ID, lobby reference) to a session so Gameye sessions map cleanly back to your own records.

For the full walkthrough with code examples for every endpoint, see the [Session API v1.2.1 release post](https://gameye.com/blog/session-api-v1-2-1/).

## Smaller changes

**GHCR support foundations.** Registry authentication was refactored to support private GitHub Container Registry images alongside Docker Hub. GHCR support is now live: see [Gameye now supports GitHub Container Registry](https://gameye.com/blog/github-container-registry-support/).

**API token expiry fix.** A timezone handling bug in token expiry validation was fixed — tokens were being rejected as expired in some timezone offsets when they should still have been valid.

**Reserved pricing update.** The reserved capacity rate is now $0.035/vCPU-hr, with the 4 GB RAM tier at $0.042/vCPU-hr. See the [pricing page](https://gameye.com/pricing/) for current rates.

**Security headers.** Missing response headers (`X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, `Permissions-Policy`) were added to SSR Worker responses.

## What’s coming next

Billing payment flows and subscription management are the primary focus — the billing backend that landed in June needs its front-end counterpart so studios can self-serve upgrades. TLS, which shipped behind a feature flag in June, continues validation and is on track to become the default for new session configurations.

Questions about any of these changes? See the [docs](https://gameye.com/docs/) or reach out directly.

**More platform updates:** [← June 2026](https://gameye.com/blog/gameye-platform-update-june-2026/)