What's new in CallSee.me
If you're building on CallSee — running your own app and letting *your* members talk to each other through our video stack — you've been doing it with a token-passthrough integration: your backend holds a key, mints a
Some meetings are products. Therapy hours, tutoring blocks, legal consultations, expert calls — sessions where the host's time is the thing being sold. Until today CallSee could host those meetings but politely
Free personal-room meetings have a 30-minute limit, and until now the timer enforcing it lived in the memory of whichever server happened to greet the first participant. If that server got recycled mid-call — routine
Private persistent rooms got a proper front door. Before, "knock to enter" was mostly a polite suggestion the browser made on its own. Now it's enforced on the server: when an org member knocks on a private always-on
Second security sweep of the day, and this one found two doors that looked closed but weren't. The first: we fixed an access-control gap so persistent rooms — the always-on spaces an org keeps around — now
This one is mostly the security team quietly walking the building and checking that every door actually locks. Magic links are now strictly single-use, defeating replay. Single sign-on now requires a verified
The headline is the v1 REST API. Notes, pins, and files all got proper public endpoints under `/api/v1/meetings/:id/*` — the three shipped on main right after v1.1.57's release cut, so this is the first prod build that exposes them. Notes are atomic. Pins are a
The headline is security. A security audit identified and fixed an access-control issue and a server-side request-handling issue in URL previews. Both are patched and covered by regression tests. An automated auth-coverage check surfaced and closed several additional
v1.1.53 never actually shipped. A build-configuration regression blocked the previous release; corrected so the database config loads correctly in the production image.
0.2.2 renamed the dist outputs (`dist/index.js` → `dist/index.cjs`, `dist/index.mjs` stayed) to match what each package's exports map advertised — but I only updated the `require` side. `module` and `exports['.'].import` still pointed at `dist/index.js`, which no
Hojt's first `npm install` of `@callsee/*` hit a packaging bug. Each package's `package.json` advertised:
Kiosks live across a reception desk or at the back of a meeting room. The control-bar buttons under `?mode=kiosk` were already sized for distance (64×64 with 32px icons) — the labels weren't. `text-xs` (12px)
The pre-join `Gå med i mötet` card sat in a flex-row beside the camera preview. Default `align-items: stretch` made the card grow to match the preview's `aspect-video` height (~326px on a normal width)
The center-screen `Ansluter` (Connecting) badge in the meeting view sat on a 15%-translucent amber backdrop with same-hue text and border. On amber wind-down backgrounds — or any tinted backdrop — that
Improved reliability logging so transient backend errors during a meeting (e.g. a brief database hiccup) are captured in a structured, queryable form instead of silently dropping a webhook or billing timestamp.
We added support for TURN over TCP/TLS so calls work on networks that block UDP entirely — corporate firewalls, hotel WiFi, etc. This release makes the relay API flexible enough to advertise multiple relay URLs
The sibling fix to v1.1.44. In some multi-server scenarios a guest could be left waiting in the lobby because the approval prompt wasn't reliably delivered — the org-member check that decides who can approve
Our per-IP WebSocket connection limit wasn't enforced consistently across our infrastructure. Reworked it to apply a single correct limit globally, so a single client can no longer open more connections than
Hojt's Past Calls panel polls `/api/calls/channel/{id}/past` today because they have no other way to know a decision was recorded or a pinboard item was added. The server-side SSE endpoint (`GET /api/v1/events/stream`) has been live for a while; 0.2.1 ships
Hojt's React-component pivot needed lifecycle callbacks beyond `onLeave`. Today they get a silent black box on token failures and have to poll their own backend to learn when the meeting actually connected. Two new props
Hojt is migrating off the iframe to a React-component embed. We didn't want a public-npm dependency, so we stood up a private package registry hosting only our `@callsee/*` SDK packages, so the SDK never depends on
Hojt reported that callsee.me's iframe finally loaded after the v1.1.38 embed-origin fix, but their self-view disappeared the moment they joined a meeting. Pre-join camera worked, in-meeting camera vanished.
The iframe embed allow-list shipped in v1.1.37 looked correct from every angle except the one that mattered: integration partners still got a white page. Partner iframes were still being blocked by a server-side request-routing bug in our embed-policy lookup. Fixed how
Some peer-to-peer calls were quietly falling back to STUN-only and failing behind symmetric NAT. Two bugs were stacked. First, the TURN credentials endpoint required a JWT cookie — guests joining via `/meeting/[roomCode]` got a 401 and never received TURN at all. It now
Two new webhook events (`decision.recorded` and `pinboard.item.added`) now actually fire. They were declared in the schema for a while but never `publishEvent`d — so anyone subscribed was getting a quiet
A tidy-up pass on legal and privacy surfaces. Billing UsageEvents now get purged after seven years — matching Swedish bookkeeping law retention without letting them linger forever. The ToS now carries a clickable link
The video meeting UI is now fully responsive to its container size. When callsee.me runs inside a 340x192px PiP panel (or any iframe narrower than 400px), it automatically switches to a stripped-down layout: single speaker
Third-party cookie restrictions in modern browsers mean an iframe can't reliably set cookies anyway — so when `?embed=true` is in the URL, we now skip the cookie consent banner entirely and return `false` from `hasPreferenceConsent()`. No device preference cookies, no guest name cookies. The meeting still works fine without them; device selection just won't remember your last pick across sessions.
When a partner like Hojt embeds a meeting via iframe with `?displayName=...`, the pre-join screen now skips everything the partner already handled: no name input (the name came from the URL), no privacy/terms text (the parent app has its own), and the button says "Join" instead of "Request to Join." Most importantly, embedded guests join directly without the WebSocket approval flow — no waiting in the lobby.
Two features in this release, both driven by the Hojt partnership.
This one was a production incident fix. A messaging-layer misconfiguration was silently dropping about half of cross-server real-time broadcasts. Fixed so signaling is reliably delivered again.
The big addition here is media-server (SFU) screen sharing. Previously, screen sharing was peer-to-peer only, which meant it degraded fast with more than 3-4 participants. With our media server (SFU), screen shares now route through the SFU, so a 20-person meeting gets the same crisp shared screen as a 1-on-1.
