Embed the player

The embed URL#

• Video id — the id from the video object.
• Account id — the number from GET /v1/account, base64-encoded as text: 42 → NDI=.
• vt — optional unless enforcement is on, and always per viewer. How to sign one.

You rarely build it by hand: every video object carries embed_url, GET …/embed returns it with an iframe snippet, and POST …/playback-tokens returns it already signed.

Embed builder#

Fill in your ids to get a URL and markup you can paste. Signed URLs belong to one viewer, so in production generate them on your server at render time.

<div class="wolvy-player" style="aspect-ratio: 16 / 9;">
  <iframe
    src="https://embed.wolvy.stream/a1b2c3d4e5f60718293a/NDI=?vt=eyJ2aWQiOiJ1c2VyLTg4MTMiLCJleHAiOjE3OTAwMDAwMDB9.XBNWyMiuLw0y7WlQkzO5s2N-eI8Ltxhs4N0uvDHM4ZM"
    title="Onboarding"
    allow="autoplay; fullscreen; encrypted-media; picture-in-picture"
    allowfullscreen
    referrerpolicy="strict-origin-when-cross-origin"
    loading="lazy"
    style="width: 100%; height: 100%; border: 0;"
  ></iframe>
</div>

The iframe#

<div class="wolvy-player">
  <iframe
    src="https://embed.wolvy.stream/a1b2c3d4e5f60718293a/NDI=?vt=…"
    title="Onboarding — week one"
    allow="autoplay; fullscreen; encrypted-media; picture-in-picture"
    allowfullscreen
    referrerpolicy="strict-origin-when-cross-origin"
    loading="lazy"
  ></iframe>
</div>

Responsive sizing#

Give the wrapper the video’s shape and let the iframe fill it. The player letterboxes anything that does not match.

.wolvy-player {
  position: relative;
  aspect-ratio: 16 / 9;      /* 9 / 16 for vertical video */
  max-width: 960px;
  background: #0b0616;
}
.wolvy-player iframe {
  position: absolute;
  inset: 0;
  width: 100%;
  height: 100%;
  border: 0;
}

Domain rules & Referer#

The embed host checks which page is embedding a video before it serves the player. The rules live in Settings → Protection → Allowed domains and apply to every video on the account.

1. A Referer must arriveNo Referer (or Origin) header — for example the URL opened directly, or a page with Referrer-Policy: no-referrer — is refused with a 403 page.
2. Blocked domains are checked firstA match is refused, whatever the allowed list says.
3. An empty allowed list lets every site embedOnce you add one domain, only listed domains work — plus wolvy.net, and play.wolvy.stream when Direct Play is on.
4. Matching is by hostnameacademy.example.com matches only itself. *.example.com matches every subdomain but not example.com — list both if you use both.

Domain tester#

This replays the embed host’s check with your rules. The defaults show the most common surprise: a wildcard that does not cover the bare domain.

Blank player or 403?#

Embeds fail quietly — a redirect to an error page inside the frame. It is almost always one of these:

Player settings#

How the player looks and behaves is set once per account in the dashboard — Settings → Player, Subtitles, Watermark and Protection — and applies to every embed. Nothing is configured per iframe, so an embed can never contradict the account.

All of it is readable in one call: GET /v1/settings/player. The API cannot change these — a key that could repaint every embed is a risk it deliberately does not carry.

App-Only mode & mobile apps#

Some browsers only have software DRM, which is easier to attack. With App-Only mode on (Settings → Protection → App-Only Mode, Multi-DRM plans), those viewers are not played in the browser — they are steered to a client with hardware-backed protection:

From your own Android app

The playback-token response includes deep_link — wolvy://play/{video_id}/{base64 account id}/{vt}. Open it and the Wolvy Player app takes over, re-verifying the signed token on Wolvy’s side. Fetch the link from your backend; never mint tokens inside the app.

import android.content.ActivityNotFoundException
import android.content.Context
import android.content.Intent
import android.net.Uri

// deepLink comes from your backend: POST /v1/videos/{id}/playback-tokens → deep_link
fun openInWolvyPlayer(context: Context, deepLink: String) {
    try {
        context.startActivity(Intent(Intent.ACTION_VIEW, Uri.parse(deepLink)))
    } catch (e: ActivityNotFoundException) {
        // Wolvy Player is not installed — send the viewer to Google Play.
        context.startActivity(
            Intent(Intent.ACTION_VIEW, Uri.parse("https://play.google.com/store/apps/details?id=com.wolvy.player"))
        )
    }
}

import { Linking } from "react-native";

// deepLink comes from your backend: POST /v1/videos/{id}/playback-tokens → deep_link
export async function openInWolvyPlayer(deepLink) {
  try {
    await Linking.openURL(deepLink); // wolvy://play/{video_id}/{base64 account id}/{vt}
  } catch {
    await Linking.openURL("https://play.google.com/store/apps/details?id=com.wolvy.player");
  }
}