The media API partners build on
Ryanflix and other partners pull media from Shannon Share Cloud programmatically — one signed endpoint, an API key you create in your workspace, and per-key rate limits by plan.
How partner access works
API keys per application
Every partner app gets a public key ID and a secret. Keys carry scopes (read today, write and transform as they ship), can be revoked instantly and rotate without downtime.
Signed, authorised requests
Every call carries your key ID, a unix timestamp and an HMAC-SHA256 signature over the body, so a captured request can never be replayed after five minutes.
Metered rate limits
Each key gets a per-minute allowance based on the account's plan. Going over returns a clear 429 with a Retry-After header, and every call is logged for billing and audit.
Full request log
Endpoint, action, response code and timestamp are recorded for every call, so you can reconcile usage against your own systems.
Keys are shown once
Authenticating a request
Three headers identify every call: your key ID, a unix timestamp and a signature over the request body.
BODY='{"action":"list","limit":25}'
TS=$(date +%s)
SIG=$(printf '%s' "$TS.POST./api/public/media.$BODY" \
| openssl dgst -sha256 -hmac "$SSC_SECRET" -hex | awk '{print $2}')
curl -X POST https://shannonsharecloud.com/api/public/media \
-H "Content-Type: application/json" \
-H "X-SSC-Key: ssc_live_7f2b...9ac1" \
-H "X-SSC-Timestamp: $TS" \
-H "X-SSC-Signature: $SIG" \
-d "$BODY"The signature is HMAC-SHA256 of {timestamp}.POST.{path}.{body} using your API secret, lowercase hex. Requests older than five minutes are rejected.
Actions
Everything runs through one endpoint: POST /api/public/media. The action field in the body decides what happens.
| Method | Action | Purpose |
|---|---|---|
| POST | {"action":"list"} | Newest media on the account — id, name, type, size, visibility. Optional limit (1–100) and search. |
| POST | {"action":"file"} | Metadata for one file by id. Storage paths are never returned. |
| POST | {"action":"signed_url"} | A temporary playback or download URL for one file. expires_in is 60–86400 seconds. |
Rate limits