Sign your viewers

curl -X POST "https://api.wolvy.net/v1/videos/a1b2c3d4e5f60718293a/playback-tokens" \
  -H "Authorization: Bearer $WOLVY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "viewer_id": "user-8813",
    "ttl_seconds": 7200
  }'

const res = await fetch("https://api.wolvy.net/v1/videos/a1b2c3d4e5f60718293a/playback-tokens", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.WOLVY_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    viewer_id: "user-8813",
    ttl_seconds: 7200,
  }),
});
const playback = await res.json();
if (!res.ok) throw new Error(`${res.status} ${playback.error.code}`);

import os

import requests

res = requests.post(
    "https://api.wolvy.net/v1/videos/a1b2c3d4e5f60718293a/playback-tokens",
    headers={"Authorization": f"Bearer {os.environ['WOLVY_API_KEY']}"},
    json={"viewer_id": "user-8813", "ttl_seconds": 7200},
    timeout=30,
)
playback = res.json()
if not res.ok:
    raise RuntimeError(f"{res.status_code} {playback['error']['code']}")

<?php
$ch = curl_init('https://api.wolvy.net/v1/videos/a1b2c3d4e5f60718293a/playback-tokens');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ' . getenv('WOLVY_API_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS     => json_encode([
        'viewer_id'   => 'user-8813',
        'ttl_seconds' => 7200,
    ]),
]);
$playback = json_decode(curl_exec($ch), true);
$status   = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
if ($status >= 400) {
    throw new RuntimeException("$status {$playback['error']['code']}");
}

import crypto from "node:crypto";

/** Sign a viewer token. exp is a Unix time in SECONDS. */
export function viewerToken(viewerId, exp, secret) {
  const payload = Buffer.from(JSON.stringify({ vid: viewerId, exp })).toString("base64url");
  const sig = crypto.createHmac("sha256", secret).update(payload).digest("base64url");
  return `${payload}.${sig}`;
}

const exp = Math.floor(Date.now() / 1000) + 3600; // Date.now() is milliseconds
const vt = viewerToken(String(user.id), exp, process.env.WOLVY_VIEWER_SECRET);

<?php
/** Sign a viewer token. $exp is a Unix time in seconds. PHP 7.4+. */
function wolvy_viewer_token(string $viewerId, int $exp, string $secret): string
{
    $b64url  = fn(string $bytes): string => rtrim(strtr(base64_encode($bytes), '+/', '-_'), '=');
    $payload = $b64url(json_encode(['vid' => $viewerId, 'exp' => $exp]));
    return $payload . '.' . $b64url(hash_hmac('sha256', $payload, $secret, true));
}

$vt = wolvy_viewer_token((string) $user->id, time() + 3600, getenv('WOLVY_VIEWER_SECRET'));

import base64
import hashlib
import hmac
import json
import os
import time


def b64url(data: bytes) -> str:
    return base64.urlsafe_b64encode(data).rstrip(b"=").decode()


def viewer_token(viewer_id: str, exp: int, secret: str) -> str:
    """Sign a viewer token. exp is a Unix time in seconds."""
    payload = b64url(json.dumps({"vid": viewer_id, "exp": exp}, separators=(",", ":")).encode())
    sig = b64url(hmac.new(secret.encode(), payload.encode(), hashlib.sha256).digest())
    return f"{payload}.{sig}"


vt = viewer_token(str(user.id), int(time.time()) + 3600, os.environ["WOLVY_VIEWER_SECRET"])

package wolvy

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"
	"encoding/json"
)

type viewerPayload struct {
	Vid string `json:"vid"`
	Exp int64  `json:"exp"`
}

// ViewerToken signs a viewer token. exp is a Unix time in seconds.
func ViewerToken(viewerID string, exp int64, secret string) (string, error) {
	body, err := json.Marshal(viewerPayload{Vid: viewerID, Exp: exp})
	if err != nil {
		return "", err
	}
	payload := base64.RawURLEncoding.EncodeToString(body)
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(payload))
	return payload + "." + base64.RawURLEncoding.EncodeToString(mac.Sum(nil)), nil
}

// vt, err := wolvy.ViewerToken(userID, time.Now().Unix()+3600, os.Getenv("WOLVY_VIEWER_SECRET"))

require "base64"
require "json"
require "openssl"

# Sign a viewer token. exp is a Unix time in seconds.
def wolvy_viewer_token(viewer_id, exp, secret)
  payload = Base64.urlsafe_encode64(JSON.generate({ vid: viewer_id, exp: exp }), padding: false)
  sig = Base64.urlsafe_encode64(OpenSSL::HMAC.digest("SHA256", secret, payload), padding: false)
  "#{payload}.#{sig}"
end

vt = wolvy_viewer_token(current_user.id.to_s, Time.now.to_i + 3600, ENV.fetch("WOLVY_VIEWER_SECRET"))

using System;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;

public static class WolvyTokens
{
    static string B64Url(byte[] bytes) =>
        Convert.ToBase64String(bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_');

    /// <summary>Sign a viewer token. exp is a Unix time in seconds. .NET 6+.</summary>
    public static string ViewerToken(string viewerId, long exp, string secret)
    {
        var payload = B64Url(JsonSerializer.SerializeToUtf8Bytes(new { vid = viewerId, exp }));
        var sig = B64Url(HMACSHA256.HashData(Encoding.UTF8.GetBytes(secret), Encoding.UTF8.GetBytes(payload)));
        return $"{payload}.{sig}";
    }
}

// var vt = WolvyTokens.ViewerToken(user.Id, DateTimeOffset.UtcNow.ToUnixTimeSeconds() + 3600, secret);

import assert from "node:assert/strict";
import { viewerToken } from "./wolvy.js";

const SECRET = "d80d15d09b7c0e56b4d787f6a212ed8bf8d53c761b6df521278f030cb12a7781";
assert.equal(
  viewerToken("user-8813", 1790000000, SECRET),
  "eyJ2aWQiOiJ1c2VyLTg4MTMiLCJleHAiOjE3OTAwMDAwMDB9.XBNWyMiuLw0y7WlQkzO5s2N-eI8Ltxhs4N0uvDHM4ZM",
);

<?php
$secret = 'd80d15d09b7c0e56b4d787f6a212ed8bf8d53c761b6df521278f030cb12a7781';
assert(
    wolvy_viewer_token('user-8813', 1790000000, $secret)
    === 'eyJ2aWQiOiJ1c2VyLTg4MTMiLCJleHAiOjE3OTAwMDAwMDB9.XBNWyMiuLw0y7WlQkzO5s2N-eI8Ltxhs4N0uvDHM4ZM'
);

SECRET = "d80d15d09b7c0e56b4d787f6a212ed8bf8d53c761b6df521278f030cb12a7781"
assert viewer_token("user-8813", 1790000000, SECRET) == (
    "eyJ2aWQiOiJ1c2VyLTg4MTMiLCJleHAiOjE3OTAwMDAwMDB9.XBNWyMiuLw0y7WlQkzO5s2N-eI8Ltxhs4N0uvDHM4ZM"
)

import crypto from "node:crypto";

// Proves your stored secret still matches the account's: mint one token through the API,
// re-sign its payload locally, compare. A mismatch means the secret was rotated.
export async function signingSecretIsCurrent(videoId) {
  const res = await fetch(`https://api.wolvy.net/v1/videos/${videoId}/playback-tokens`, {
    method: "POST",
    headers: { Authorization: `Bearer ${process.env.WOLVY_API_KEY}`, "Content-Type": "application/json" },
    body: JSON.stringify({ viewer_id: "secret-check", ttl_seconds: 60 }),
  });
  const { vt } = await res.json();
  const [payload, sig] = vt.split(".");
  const mine = crypto.createHmac("sha256", process.env.WOLVY_VIEWER_SECRET).update(payload).digest("base64url");
  return mine === sig;
}

<?php
// Mint one token through the API, re-sign its payload with the stored secret, compare.
function wolvy_signing_secret_is_current(string $videoId): bool
{
    $ch = curl_init('https://api.wolvy.net/v1/videos/' . rawurlencode($videoId) . '/playback-tokens');
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . getenv('WOLVY_API_KEY'), 'Content-Type: application/json'],
        CURLOPT_POSTFIELDS     => json_encode(['viewer_id' => 'secret-check', 'ttl_seconds' => 60]),
    ]);
    [$payload, $sig] = explode('.', json_decode(curl_exec($ch), true)['vt']);
    $mine = rtrim(strtr(base64_encode(hash_hmac('sha256', $payload, getenv('WOLVY_VIEWER_SECRET'), true)), '+/', '-_'), '=');
    return hash_equals($sig, $mine);
}

const accountId = 42; // GET /v1/account → id
const base = `https://embed.wolvy.stream/${videoId}/${Buffer.from(String(accountId)).toString("base64")}`;
const embedUrl = `${base}?vt=${encodeURIComponent(vt)}`;

<?php
$accountId = 42; // GET /v1/account → id
$embedUrl  = 'https://embed.wolvy.stream/' . rawurlencode($videoId) . '/' . base64_encode((string) $accountId)
           . '?vt=' . rawurlencode($vt);

import base64
from urllib.parse import quote

account_id = 42  # GET /v1/account → id
account = base64.b64encode(str(account_id).encode()).decode()
embed_url = f"https://embed.wolvy.stream/{quote(video_id)}/{account}?vt={quote(vt)}"