# Build protected video _into your product._

> Build DRM-protected video into your product: upload by URL, sign every viewer, embed the player and verify webhooks — or install the WordPress plugin.

Source: https://docs.wolvy.net/ · Wolvy Developer API v1 · updated 2026-11-12

_Developer docs · API v1_

Upload by URL, sign every viewer, drop in one iframe and let webhooks tell you when encoding is done. One REST API, a WordPress plugin, and three small pieces of code only your backend can write.

[Start the quickstart](https://docs.wolvy.net/quickstart/) [API reference](https://docs.wolvy.net/api/)

_Your first call_

```bash
curl https://api.wolvy.net/v1/account \
  -H "Authorization: Bearer $WOLVY_API_KEY"
```

_200 · response (trimmed)_

```json
{
  "object": "account",
  "id": 42,
  "plan": {
    "name": "DRM Pro",
    "protection": "drm"
  },
  "rate_limits": {
    "per_minute": 120,
    "per_day": 10000
  }
}
```

REST + JSON · Bearer API keys · Cursor pagination · Idempotent POSTs · Signed webhooks · Multi-DRM or ClearKey by plan

_What you build_

## Three pieces of code are yours. Wolvy runs the rest.

Most of a protected-video pipeline is ours to operate. What needs **your** code is the part that only your server can do safely — because only your server holds the secrets and knows who your users are.

### Call the API from your server

Keys are secrets. The API sends no CORS headers, so it cannot be called from a browser — by design.

`Authorization: Bearer wv_live_…`

### Sign every viewer

A short HMAC over `{vid, exp}` so the watermark shows who is watching — and nobody can pretend to be someone else.

`vt = base64url(json) + "." + base64url(hmac)`

### Verify every webhook

Check the HMAC over the raw body and the timestamp before you act on an event.

`Wolvy-Signature: t=1790000000,v1=e43bfc…`

_Wolvy runs_

### Everything between your URL and the viewer’s screen

- Downloading your source and encoding the resolution ladder
- Multi-DRM (Widevine, PlayReady, FairPlay) or ClearKey, by plan
- CDN delivery and the brandable player
- Drawing the dynamic watermark from your signed token
- Session logs and the security-event audit trail
- App-Only mode for devices without hardware DRM

_Architecture_

## How the pieces fit

Three hosts, three arrows that carry your code. The numbers match the cards above.

Solid yellow arrows carry your code. The dashed arrow is the browser talking to Wolvy directly — nothing to build there beyond the iframe.

_Learn_

## Guides

_10 minutes_

### Quickstart

Key → first call → upload → embed. The shortest path to a playing video.

Read

_Guide_

### Upload by URL

Hand Wolvy a URL, follow queued → ready, add captions, chapters and moments.

Read

_Needs your code_

### Sign your viewers

Sign who is watching so the watermark and session logs name a real person.

Read

_Guide_

### Embed the player

The iframe that DRM needs, domain rules, and handing viewers to the Android app.

Read

_Needs your code_

### Webhooks

Get told when encoding finishes. Verify the signature before you trust it.

Read

_44 endpoints_

### API reference

Every route with parameters, examples, errors — plus a request builder.

Read

_Skip the code_

## Plugins & tools

![Wolvy Video plugin banner](https://docs.wolvy.net/assets/wordpress/banner.webp)

Live on WordPress.orgv1.0.0

### Wolvy Video for WordPress

Everything on this site, already written: signed viewer tokens minted on your server, a library browser in wp-admin, analytics, a health screen that names what would break playback, and a webhook receiver.

Gutenberg blockShortcodeElementor widget Template tagMembership-ready filters

[Get it on WordPress.org](https://wordpress.org/plugins/wolvy-video/) [Plugin guide](https://docs.wolvy.net/wordpress/)

_Postman_

### API collection

Every endpoint, pre-wired auth and saved ids, so the folders run in order. Import both files and set `api_key`.

[Collection](https://docs.wolvy.net/downloads/wolvy-developer-api.postman_collection.json) [Environment](https://docs.wolvy.net/downloads/wolvy-developer-api.postman_environment.json)

_Android_

### Wolvy Player app

With App-Only mode on, viewers without hardware DRM watch in the app. The token response gives you the deep link.

App-Only mode

_Another platform?_

### Building an integration

Moving an LMS, a store or an app onto Wolvy? Tell us what you are building and we will walk your team through it.

Talk to us

_Facts_

## API at a glance

## Common questions

### What is Wolvy?

Wolvy is a video hosting platform that encrypts every video with Multi-DRM or ClearKey and streams it only to the people you allow. The Developer API v1 at `https://api.wolvy.net` lets your own server upload videos, sign viewers, read analytics and receive webhooks.

### Do I have to write code to use Wolvy?

No. You can upload in the dashboard and paste the embed, or install the [WordPress plugin](https://docs.wolvy.net/wordpress/). Code is only needed when your own product drives Wolvy — and then three pieces are yours: calling the API from your server, [signing viewers](https://docs.wolvy.net/viewer-tokens/) and [verifying webhooks](https://docs.wolvy.net/webhooks/).

### Can I call the Wolvy API from the browser?

No. The API sends no CORS headers and an API key is a secret, so every call comes from your server. All a browser ever sees is the embed URL and a short-lived [viewer token](https://docs.wolvy.net/viewer-tokens/).

### Which languages can I use?

Any language that can make an HTTPS request — it is plain REST and JSON. The guides show cURL, Node.js, Python and PHP side by side, token signing adds Go, Ruby and C#, and the [Postman collection](https://docs.wolvy.net/downloads/wolvy-developer-api.postman_collection.json) is ready to import.

### Do I need a paid plan for API access?

Yes. An API key belongs to an account with an active plan; calls without one fail with [`no_active_plan`](https://docs.wolvy.net/api/#error-no_active_plan). Storage, bandwidth and the protection level — Multi-DRM or ClearKey — come from that same plan.

### How do I get started?

Create an API key, call `GET /v1/account` to prove it works, upload a video by URL and put it on a page with a signed token. The [quickstart](https://docs.wolvy.net/quickstart/) walks through all five steps in about ten minutes.

_Support_

## Getting help

Every API response carries an `X-Request-Id` header (and errors repeat it as `error.request_id`). Email it to [contact@wolvy.net](mailto:contact@wolvy.net) and we can find the exact request — no stack traces or keys needed. Account questions go through the [dashboard](https://dash.wolvy.net/login); viewers who need the app can start at the [Wolvy Player page](https://wolvy.net/player-app/).

Something wrong or unclear on this page? Email [contact@wolvy.net](mailto:contact@wolvy.net?subject=Docs%3A%20Overview) — include the page name.