Choose an authentication method

Backend integrations

Partners authenticate with an API key:

Authorization: ApiKey YOUR_API_KEY

Use this header on job, file, batch, and account-owned playlist requests. No Discord login, bot token, Origin header, or browser cookie is needed for a backend API-key caller.

Keep the key in your service's environment. Your frontend should call your backend, which decides whether the current user may request a download. A shared partner key must not be embedded in a website or mobile application.

A key can have an expiry or be issued without a scheduled expiry. It can still be revoked. Partner keys cannot create, list, or revoke other credentials. Contact partnerships for issuance or rotation.

Website users

The website signs users in through Discord. The API requests identity access, not the user's email. It establishes its own HttpOnly session cookie. Browser calls use credentials:

const response = await fetch("https://api.mediafilez.online/api/v1/playlists", {
    credentials: "include"
});

Only configured website origins may use credentialed CORS. Session-authenticated writes also require a trusted Origin. Adding an API key to browser code is not a fix for a CORS error.

Ownership

Keys and website sessions belonging to the same API account share ownership and limits. Separate accounts cannot read each other's private jobs or files. Returning 404 for an inaccessible resource is intentional.

A partner account does not automatically become linked to a Discord server or to the Discord accounts of your users.

See the authentication reference for supported session endpoints.