OpenAPI
On any running deploy, open:API groups
| Prefix | Audience | Notes | | --- | --- | |/api/v1/* | Viewers / tenant clients | Tenant resolved from Host + session; catalog, playback, billing checkout, domains, profiles, … |
| /api/operator/* | Operator | Themes, branding, plans, settings |
| /api/admin/* | Operator activation / onboarding / health | License connect flows |
| /api/webhooks/stripe | Stripe | Configure in Stripe Dashboard |
| /api/internal/jobs/run | Scheduler | Header X-Streamly-Cron-Secret |
| /api/auth/refresh | Sessions | Keep middleware lean on Workers |
Client rules
- Always call your Streamly host (
NEXT_PUBLIC_STREAMLY_API_BASE) — do not call TMDB from Flutter/browsers; use serverTMDB_API_TOKEN+ Streamly APIs. - Viewer vs operator cookies are separate — see Authentication Flow.
- Custom domains must preserve
Hostfor correct tenant scoping — see Domain.