2026.4.3

Michael-A-Kuykendall/shimmy2026.4.3May 7, 2026by devlikepro

AI Summary

This release adds MCP support, introduces session key scopes for security, and fixes critical issues with the GOWS and NOWEB engines regarding session management and media downloads.

Key Highlights

Added MCP (Model Context Protocol) app support
Introduced Session Key Scopes for API security
Added new API endpoint for generating message IDs
Fixed session startup delays after server restart

New Features

MCP integration
Session Key Scopes
Message ID generation API
Query parameter authentication

Full Release Notes

🆕 **New**

-   `2026.4.3` - [**🧩 MCP**](https://waha.devlike.pro/docs/apps/mcp/) - [#1925](https://github.com/devlikeapro/waha/issues/1925)
-   `2026.4.3` - **API Key** - [**🔒 Session Key Scopes**](https://waha.devlike.pro/docs/how-to/security/#session-key-scopes) (read/send/etc) - [#2035](https://github.com/devlikeapro/waha/issues/2035)
-   `2026.4.3` - **API** - `GET /api/{session}/new-message-id` - generate message ID before sending
-   `2026.4.3` - **NOWEB**, **GOWS** - Provide message ID in send request - [#2054](https://github.com/devlikeapro/waha/issues/2054)
-   `2026.4.3` - **Auth** - [**🔒 Use `?x-api-key` query parameter**](https://waha.devlike.pro/docs/how-to/security/#use-x-api-key-query-parameter) for authentication

**🧩 Apps**

-   `2026.4.3` - [**🧩 MCP**](https://waha.devlike.pro/docs/apps/mcp/) - [#1925](https://github.com/devlikeapro/waha/issues/1925)

🛠️ **Fixes**
- `2026.4.3` - **GOWS** - Add tctoken lifecycle - fix #2050
- `2026.4.3` - **NOWEB** - Fix missing Facebook and Instagram ADs messages - fix #1922
- `2026.4.3` - **GOWS** - Fix "Sessions take a long time to start after server restart" - fix #2012
- `2026.4.3` - **GOWS** - Fix 403 on some media download - use re-upload request from the phone for this - fix #2049


⚙️ **Updates**
- `2026.4.3` - **NOWEB** - up engine
- `2026.4.3` - **GOWS** - up engine

**Full Changelog**: https://github.com/devlikeapro/waha/compare/2026.4.2...2026.4.3