Wolvy DOCS
WolvyDOCS
Dashboard wolvy.net Plugin on WordPress.org

Developer docs · API v1

Build protected video into your product.

Upload by URL, sign every viewer, drop in one iframe and let webhooks tell you when encoding is done. One REST API, a WordPress plugin, and three small pieces of code only your backend can write.

Start the quickstart API reference
Your first call 
curl https://api.wolvy.net/v1/account \
  -H "Authorization: Bearer $WOLVY_API_KEY"
200 · response (trimmed) 
{
  "object": "account",
  "id": 42,
  "plan": {
    "name": "DRM Pro",
    "protection": "drm"
  },
  "rate_limits": {
    "per_minute": 120,
    "per_day": 10000
  }
}
REST + JSON Bearer API keys Cursor pagination Idempotent POSTs Signed webhooks Multi-DRM or ClearKey by plan

What you build

Three pieces of code are yours. Wolvy runs the rest.#

Most of a protected-video pipeline is ours to operate. What needs your code is the part that only your server can do safely — because only your server holds the secrets and knows who your users are.

01

Call the API from your server

Keys are secrets. The API sends no CORS headers, so it cannot be called from a browser — by design.

Authorization: Bearer wv_live_… 02

Sign every viewer

A short HMAC over {vid, exp} so the watermark shows who is watching — and nobody can pretend to be someone else.

vt = base64url(json) + "." + base64url(hmac) 03

Verify every webhook

Check the HMAC over the raw body and the timestamp before you act on an event.

Wolvy-Signature: t=1790000000,v1=e43bfc…

Wolvy runs

Everything between your URL and the viewer’s screen

  • Downloading your source and encoding the resolution ladder
  • Multi-DRM (Widevine, PlayReady, FairPlay) or ClearKey, by plan
  • CDN delivery and the brandable player
  • Drawing the dynamic watermark from your signed token
  • Session logs and the security-event audit trail
  • App-Only mode for devices without hardware DRM

Architecture

How the pieces fit#

Three hosts, three arrows that carry your code. The numbers match the cards above.

Wolvy integration architecture Your server calls api.wolvy.net with a Bearer API key, and receives signed webhooks from it. Your server sends the viewer's browser a page containing an iframe with a signed viewer token. The browser loads the player from embed.wolvy.stream, which checks the Referer and verifies the token. YOUR SERVER Your backend Node · PHP · Python · anything API key · signing secret VIEWER’S BROWSER Your page <iframe src="…?vt=…"> WOLVY api.wolvy.net Library, uploads, tokens, analytics, webhooks embed.wolvy.stream The DRM player, domain rules, watermark and sessions 01 REST calls Bearer wv_live_… 03 Signed webhooks 02 Page with a signed vt Player loads in the iframe Referer checked · vt verified
Solid yellow arrows carry your code. The dashed arrow is the browser talking to Wolvy directly — nothing to build there beyond the iframe.

Learn

Guides#

10 minutes

Quickstart

Key → first call → upload → embed. The shortest path to a playing video.

Read Guide

Upload by URL

Hand Wolvy a URL, follow queued → ready, add captions, chapters and moments.

Read Needs your code

Sign your viewers

Sign who is watching so the watermark and session logs name a real person.

Read Guide

Embed the player

The iframe that DRM needs, domain rules, and handing viewers to the Android app.

Read Needs your code

Webhooks

Get told when encoding finishes. Verify the signature before you trust it.

Read 44 endpoints

API reference

Every route with parameters, examples, errors — plus a request builder.

Read

Skip the code

Plugins & tools#

Wolvy Video plugin banner
Live on WordPress.orgv1.0.0

Wolvy Video for WordPress

Everything on this site, already written: signed viewer tokens minted on your server, a library browser in wp-admin, analytics, a health screen that names what would break playback, and a webhook receiver.

Gutenberg blockShortcodeElementor widget Template tagMembership-ready filters
Get it on WordPress.org Plugin guide
Postman

API collection

Every endpoint, pre-wired auth and saved ids, so the folders run in order. Import both files and set api_key.

Collection Environment
Android

Wolvy Player app

With App-Only mode on, viewers without hardware DRM watch in the app. The token response gives you the deep link.

App-Only mode Another platform?

Building an integration

Moving an LMS, a store or an app onto Wolvy? Tell us what you are building and we will walk your team through it.

Talk to us

Facts

API at a glance#

Base URL
https://api.wolvy.net/v1
Authentication
Authorization: Bearer wv_live_… — keys from Settings → API
Format
JSON in, JSON out, real HTTP status codes
Errors
Branch on error.code; quote request_id to support
Pagination
Cursors — limit + starting_after
Safe retries
Idempotency-Key on every POST, kept 24 h
Rate limits
120 requests/minute and 10,000/day per key by default
From a browser
Never. No CORS headers — keys stay on your server

Support

Getting help#

Every API response carries an X-Request-Id header (and errors repeat it as error.request_id). Email it to [email protected] and we can find the exact request — no stack traces or keys needed. Account questions go through the dashboard; viewers who need the app can start at the Wolvy Player page.