Server API · v1

Playback authentication and advanced options

Call POST /api/videos/{videoId}/otp from your backend with the video's Project API Secret. Return the otp and playbackInfo strings to one Viewer player instance. The pair is single use: the first valid POST /api/playback/initialize consumes it atomically and creates a session. A refresh or second player needs a new pair.

curl -X POST 'https://api.wecloud.biz/api/videos/asset_ID/otp' \
  -H 'Authorization: Apisecret YOUR_PROJECT_SECRET' \
  -H 'Content-Type: application/json' \
  -d '{"ttl":300,"userId":"opaque-viewer-reference"}'

Omitting ttl uses the compatible six-hour default (21,600 seconds). This example explicitly requests five minutes. A configured maximum rejects excessive TTLs. An optional Idempotency-Key replays the original pair for 24 hours without renewing its validity, even after consumption. Use a new key for a new session.

The request can carry compatible playback policy options such as annotate, whitelisthref, and ipGeo. annotate feeds the existing bounded moving watermark; whitelisthref is an optional origin pattern, not a mandatory Project domain allowlist. IP and geo rules use verified ingress metadata. Pass an opaque Customer Viewer Reference, never a Member email. Inspect the OpenAPI reference for the exact request schema and public errors.