API referencePlayback
AES-128 content key
AES-128 content key
GET
/v1/playback/key/{videoId}Returns the raw 16-byte AES-128 key for an encrypted video. Auth: the
t/e/s signed-URL query trio. Rate limit: 120 requests per 60 s
per session. Served with
Cache-Control: no-store, no-cache, must-revalidate, max-age=0.
Error codes: signature_invalid (403), signature_expired (403),
session_invalid (403), referrer_not_allowed (403),
key_not_found (404), key_unreadable (500).
Authentication
- This operation needs no authentication.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
videoId | path | string (Ulid) | Yes | — |
t | query | string | Yes | base64url HMAC-SHA256 over <path>|<expiry>|<sessionId>. Minted by the server into manifestUrl; clients never construct it. |
e | query | integer | Yes | Token expiry as a Unix timestamp in seconds. |
s | query | string (Ulid) | Yes | Playback session id the token is bound to. |
Request body
This operation takes no request body.
Responses
| Status | Meaning |
|---|---|
200 | The 16-byte key. |
403 | The credential is valid but does not permit this action. The per-operation description lists the exact error.code values. |
404 | The resource does not exist or is not visible to this caller. |
429 | Rate limit exceeded. |
500 | The server failed to complete the request. |
Try it
GET
/v1/playback/key/{videoId}No authentication
API playground
Send a live request to the Videohati API; this operation needs no authentication.
base64url HMAC-SHA256 over `<path>|<expiry>|<sessionId>`. Minted by the server into `manifestUrl`; clients never construct it.
Token expiry as a Unix timestamp in seconds.
Playback session id the token is bound to.
https://api.staging.videohati.com/v1/playback/key/{videoId}