Back to Catalog
RomM logo

RomM

Beautiful, powerful, self-hosted rom manager and player

app

Alternative to: antstream arcade

Website Repository Docs
About Versions (100)
Back to Versions

4.8.0-beta.1

2026-03-22

Highlights

Client API tokens

API tokens are a safer way for apps and devices to connect without sharing user credentials. A new QR-based pairing flow makes setup quick, with support for regeneration and revocation when needed. #3114

Screenshot 2026-03-13 at 9 15 48 PMScreenshot 2026-03-13 at 9 25 26 PM

Chunked uploads

Goodbye failed uploads and incessant timeouts! ROMs will now upload in smaller chunks, allowing for more reliable transfers even on spotty connections. #3076

Screenshot 2026-03-13 at 9 17 24 PM

Local LaunchBox metadata import

Have a local LaunchBox installation packed with games? You can now import metadata directly from it, including cover art, screenshots and video previews. #2922

Screenshot 2026-03-13 at 9 26 29 PM

Minor changes

Fixes

Other changes

[!NOTE] API Changes

⚠️ Most API endpoints that accept form input(s) are now fully typed and allow for partial updates. Field names were (mostly) unchanged, so existing API calls should continue to work as expected. Affect endpoints:

  • PUT /api/roms: Update Rom
  • POST /api/collections: Create Collection
  • PUT /api/collections: Update Collection
  • POST /api/collections/smart: Create SmartCollection
  • PUT /api/collections/smart: Update SmartCollection
  • POST /api/saves: Upload Save
  • PUT /api/saves: Update Save
  • POST /api/states: Upload State
  • PUT /api/states: Update State
  • POST /api/screenshots: Upload Screenshot

Client tokens expose a new batch of endpoints:

  • POST /api/client-tokens: Create client token
  • GET /api/client-tokens: List client tokens
  • DELETE /api/client-tokens/{token_id}: Revoke client token
  • POST /api/client-tokens/regenerate: Regenerate client token secret
  • POST /api/client-tokens/pair: Pair client token via QR code
  • GET /api/client-tokens/pair/{code}/status: Check QR pairing status
  • POST /api/client-tokens/exchange: Exchange pairing code for client token
  • GET /api/client-tokens/all: Get all client tokens (admin only)
  • DELETE /api/client-tokens/{token_id}/admin: Revoke any client token (admin only)

⚠️ RomFile endponts have been moved:

  • GET /api/roms/files/{rom_id} -> POST /api/roms/{rom_id}/files
  • GET /api/roms/files/{rom_id}/content -> /{id}/files/content/{file_name}

Other changes:

  • GET /api/stats endpoint now includes additional metadata coverage and region breakdowns
    • Added METADATA_COVERAGE and REGION_BREAKDOWN fields to StatsReturn
  • Added path_video field and ra_hash fields to DetailedRomSchema and SimpleRomSchema
  • Added ra_hash field to RomFileSchema
  • Added firmware_count field to PlatformSchema
  • Added highest_award_kind field to RAUserGameProgression
  • Added refresh_token and refresh_expires to TokenResponse
  • UPLOAD_TIMEOUT has been removed from the /api/heartbeat response

[!NOTE] Environment Variables

UPLOAD_TIMEOUT has been removed in favour of chunked uploads OAUTH_ACCESS_TOKEN_EXPIRE_SECONDS: Access token lifetime (in seconds, default 30 minutes) OAUTH_REFRESH_TOKEN_EXPIRE_SECONDS: Refresh token lifetime (in seconds, default 7 days) INVITE_TOKEN_EXPIRY_SECONDS: Invite token lifetime (in seconds, default 10 minutes) OIDC_SERVER_METADATA_URL: URL to the OIDC provider metadata endpoint OIDC_RP_INITIATED_LOGOUT: Enable RP-initiated logout flow (default false) OIDC_END_SESSION_ENDPOINT: OIDC end-session endpoint override URL

New Contributors

Full Changelog: https://github.com/rommapp/romm/compare/4.7.0…4.8.0-beta.1

Changelog on GitHub →