Skip to content
REST API

Authentication

Use Sanctum bearer tokens or scoped X-API-Key credentials.

Sanctum bearer tokens

Register or log in through /api/v1/auth/*. Successful responses return a Sanctum token once. Send it in the Authorization header and revoke it through the logout endpoint.

curl https://play.earnloop.online/api/v1/auth/me \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Accept: application/json"

Scoped API keys

Account owners create API keys under Account → API keys. Plaintext is shown once; BaPlay stores only a SHA-256 digest. Send the key with X-API-Key.

curl https://play.earnloop.online/api/v1/videos \
  -H "X-API-Key: baplay_REDACTED" \
  -H "Accept: application/json"

Use the least privilege required: videos:read, videos:write, subtitles:write, or webhooks:manage. Never place keys in query strings or browser bundles.

API errors

Authentication failures use the standard JSON envelope with success: false, a stable error code, human-readable message, request ID, API version, and timestamp.