Developers

The media API partners build on

Ryanflix and other partners pull media from Shannon Share Cloud programmatically — one signed endpoint, an API key you create in your workspace, and per-key rate limits by plan.

How partner access works

API keys per application

Every partner app gets a public key ID and a secret. Keys carry scopes (read today, write and transform as they ship), can be revoked instantly and rotate without downtime.

Signed, authorised requests

Every call carries your key ID, a unix timestamp and an HMAC-SHA256 signature over the body, so a captured request can never be replayed after five minutes.

Metered rate limits

Each key gets a per-minute allowance based on the account's plan. Going over returns a clear 429 with a Retry-After header, and every call is logged for billing and audit.

Full request log

Endpoint, action, response code and timestamp are recorded for every call, so you can reconcile usage against your own systems.

Keys are shown once

Your API secret is displayed a single time when it is created. Store it in your own secret manager — support will never ask you for it.

Authenticating a request

Three headers identify every call: your key ID, a unix timestamp and a signature over the request body.

BODY='{"action":"list","limit":25}'
TS=$(date +%s)
SIG=$(printf '%s' "$TS.POST./api/public/media.$BODY" \
  | openssl dgst -sha256 -hmac "$SSC_SECRET" -hex | awk '{print $2}')

curl -X POST https://shannonsharecloud.com/api/public/media \
  -H "Content-Type: application/json" \
  -H "X-SSC-Key: ssc_live_7f2b...9ac1" \
  -H "X-SSC-Timestamp: $TS" \
  -H "X-SSC-Signature: $SIG" \
  -d "$BODY"

The signature is HMAC-SHA256 of {timestamp}.POST.{path}.{body} using your API secret, lowercase hex. Requests older than five minutes are rejected.

Actions

Everything runs through one endpoint: POST /api/public/media. The action field in the body decides what happens.

MethodActionPurpose
POST{"action":"list"}Newest media on the account — id, name, type, size, visibility. Optional limit (1–100) and search.
POST{"action":"file"}Metadata for one file by id. Storage paths are never returned.
POST{"action":"signed_url"}A temporary playback or download URL for one file. expires_in is 60–86400 seconds.

Rate limits

Free keys get 30 requests a minute, Starter 120, Pro 600, Studio 1,200 and Enterprise 6,000. Over the limit you get a 429 with a Retry-After header — wait, then retry.

Ready to build?

Read the docs

Quickstarts, SDK snippets and error references.

Documentation

Pick a plan

Call volume, bandwidth and seats scale with your tier.

See pricing

Request partner access

Enterprise keys, custom quotas and dedicated support.

Contact us