Authentication and accounts

Partner API keys

Authorization: ApiKey YOUR_API_KEY

Ask [email protected] for API access. Store the issued key in your backend's MEDIAFILEZ_API_KEY environment variable and send the header above on authenticated requests.

GET /users/me checks the key and returns its API account. No request body or Discord login is needed. A partner key cannot create, list, or revoke credentials.

Never put a key in browser code, a mobile app, a URL, or a public log. Anyone holding it can act as your integration account. If it leaks, contact support for revocation and replacement.

Expiry and replacement

A key's expiry is agreed when it is issued. A key without a scheduled expiry can still be revoked. A replacement key on the same account shares that account's files, playlists, and limits.

For planned rotation, ask for a replacement, update your backend, confirm it works, and arrange revocation of the old key. If the old key is compromised, arrange revocation immediately.

Website sign-in

Users of the official website sign in with Discord through the login page. The website uses a session cookie; users don't need to paste an API key into it.

For your own frontend, call your backend and keep the partner key there. The authentication guide explains this separation.

Check your account

The response contains account information. Keep it within your service rather than showing it to every end user.

curl --fail-with-body -X GET 'https://api.mediafilez.online/api/v1/users/me' \
    -H "Authorization: ApiKey $MEDIAFILEZ_API_KEY"