Mobile API

The Mobile API plugin gives your site a JSON API for an Android or iPhone app, or any other program: members sign in with a token, then browse, search, watch, like, comment, subscribe, upload and read their notifications. It is for owners who have (or will commission) their own native app. If you only want the site itself as an installable app, the Mobile Apps plugin does that without any app programming.

Switching it on

Mobile API is sold as a premium plugin on license.faruk.bd (addon code mobile-api). Make sure your licence includes it: buy it there, then press Check again now on Admin → License; the addon then shows in the Addons row of that page. After that, switch it on at Admin → Plugins.

Switching it on makes the sign-in token table and a first app key. The admin menu gets a Mobile API group under Plugins with two pages: Mobile API (admin/plugin.php?code=mobile-api) and API documentation (...&page=docs).

Where it answers

https://your-site.com/plugins/mobile-api/v1.php/<route>
https://your-site.com/plugins/mobile-api/v1.php?r=<route>

Use the second form on a server that hides the part after v1.php/ (common on nginx). Every answer is JSON:

{"ok":true,"data":...}
{"ok":false,"error":{"code":"...","message":"..."}}

Reading is a GET; doing something is a POST. Parameters may come in the query string, as form fields, or as a JSON body. Lists take page and per_page (up to 50) and answer meta.page, meta.per_page and meta.total. Times are ISO-8601 in UTC; video sources are complete playable addresses, one per quality.

Signing in

curl -X POST https://your-site.com/plugins/mobile-api/v1.php/auth/login \
  -d "login=USERNAME" -d "password=PASSWORD" -d "device=My phone"
curl https://your-site.com/plugins/mobile-api/v1.php/videos?sort=popular \
  -H "Authorization: Bearer TOKEN"

auth/login takes a username or e-mail and answers a token, its expiry and the member. Send the token on every request as Authorization: Bearer <token>. A member with two-step sign-in gets the answer two_step and sends the code again as code with the same login and password. The API never uses a browser's cookies, so a web page cannot ride on a signed-in tab.

The settings

Admin → Mobile API shows whether the API is on, the number of routes, apps signed in and members using it today, then:

Signed-in apps lists every live token with member, device, address, last use and expiry: Sign out ends one, Sign everybody out ends them all. Every route lists all routes; those marked you need a token.

The routes

Other plugins add their own routes while they are on: Shorts (shorts, shorts/{uid}), Live Streaming (live, live/{uid}, live/{uid}/chat), Movies & Series (movies, movies/{slug}), Messages (messages, messages/{username}) and Mobile Apps (qr/approve, app/config). The Every route table always shows the full list for your site.

Uploads follow the same rules as the website: the member's role, package limits and moderation apply.

Errors

API documentation page

API documentation explains all of the above in more depth: every setting, every route with an example, code samples in JavaScript, Kotlin (Android), Swift (iOS), Flutter (Dart) and PHP, sign-in by QR code, advice on building an app, and how a plugin adds routes of its own. Give that page to your app developer.

Tips and limits

• Start an app with GET config: it tells which plugins are on, so the app can show the right tabs.
• Call POST videos/{uid}/view once playback begins, so view counts and history stay right.
• There is no push service: the app polls GET notifications, and GET me carries the unread count.
• The cron job App sign-ins removes expired tokens once a day (Scheduled jobs).
• The API is for your own apps. PlayTube's old API and its mobile apps do not work with it.