This API provides direct access to the signed song URLs, allowing you to integrate music into your backends or the apps with ease. This API facilitates two distinct use cases.
The first use case entails requesting access to the music assets for the purpose of storing or ingest them into your own system. This implies that the music files are transmitted to the end user via your system, rather than directly from Tuned Global. In this scenario, there is no need to include any supplementary information in the header. Additionally, the transmission of territory information is not required, as it is assumed that territorial access control will be implemented within your own system.
The second use case involves delivering streaming functionality to end users directly from the Tuned Global system, using this API. In this context, it is crucial to consider territorial restrictions and to include additional header information that enhances resilience against URL hijacking. For specifics regarding the usage of session_id information, refer to the details provided below.
The signed song URL will only provide you temporary access to the music files. This TTL (Time to live) is measured in seconds and hence you should only request the URL when you need it and then consume it immediately.
Session salting Usage notes. Generate a unique GUID for each request for a play (GetStream). Pass this GUID to the GetStreamAPI in a http header with the key called ‘session_id’. The GetStream API will read the value of this session_id key from the header and add its encrypted value to the CDN token when returning the stream location URL.
You MUST use the same session_id value that was passed into the GetStream API above, when calling the returned CDN url. As per above this is a key called ‘session_id’ within the http header request. It is important to note that the name and value of this session_id key in the http header of the getStream API and CDN url, are case sensitive, the values have to be an exact match. These values are matched to the encrypted token and if they are not identical you will be denied a stream and get a 401 error. See examples below
