> ## Documentation Index
> Fetch the complete documentation index at: https://docs.originx.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Partners API

> Programmatic, read/stream access to a studio's licensed catalog — plus usage analytics — for approved OriginX distribution partners.

The Partners API lets approved distributors, platforms, and broadcasters pull a studio's catalog programmatically: browse and search content, resolve stream URLs, and read usage analytics — scoped to exactly what each partner has been granted.

Prefer not to call the REST API directly? Use the official [SDK](/api-reference/sdk).

## Base URL

```text theme={null}
https://studio-dashboard-api.black-poetry-4fa5.workers.dev
```

## How authentication works

The API uses a **two-step, key → token** flow:

<Steps>
  <Step title="Get your credentials">
    A studio admin creates your partner record in **Partners** inside the OriginX dashboard, grants per-series access (`read` and/or `stream`), and shares your **API key** and **API secret**. The secret is shown once — store it securely.
  </Step>

  <Step title="Exchange them for a token">
    `POST /api/partner/auth` with `{ "api_key", "api_secret" }`. You get back a **JWT valid for 24 hours**.
  </Step>

  <Step title="Call the API with the token">
    Send the token as `Authorization: Bearer <token>` on every other endpoint. Use `GET /api/partner/auth/verify` to check a token is still valid.
  </Step>
</Steps>

```bash theme={null}
# 1 — authenticate
curl -X POST https://studio-dashboard-api.black-poetry-4fa5.workers.dev/api/partner/auth \
  -H "Content-Type: application/json" \
  -d '{ "api_key": "YOUR_KEY", "api_secret": "YOUR_SECRET" }'

# 2 — use the token
curl https://studio-dashboard-api.black-poetry-4fa5.workers.dev/api/partner/content/catalog \
  -H "Authorization: Bearer eyJ..."
```

<Warning>
  Treat your API secret like a password. If it leaks, ask the studio admin to regenerate it from the Partners tab — the old secret is revoked immediately.
</Warning>

## Rate limits

| Endpoint group | Limit (per partner)   |
| -------------- | --------------------- |
| Authentication | 10 requests / minute  |
| Content        | 100 requests / minute |
| Streaming      | 100 requests / minute |

Exceeding a limit returns `429 Too Many Requests`. The SDK retries with exponential backoff.

## Error codes

| Status | Meaning                                         |
| ------ | ----------------------------------------------- |
| `400`  | Bad request — missing/invalid parameters        |
| `401`  | Unauthorized — bad credentials or expired token |
| `403`  | Forbidden — no access to the requested resource |
| `404`  | Not found                                       |
| `429`  | Rate limit exceeded                             |
| `500`  | Server error                                    |