• The API key is only in the gateway; the app only knows the gateway's URL.
  • Store the session token and playback_key in secure storage; never the password.
  • On start: refresh-session, then playback-routes.
  • Branch on code. session_expired → refresh-session once; other 401 → sign in again; 403 → show it and keep the session.
  • Build playback tokens with the panel's clock (server_time).
  • Never retry a 401, 403 or 429 in a loop. Repeated failures get the IP blocked.
  • Report history on pause, stop and end, and at most every 2 minutes while playing; channels once after ~30 s. Drop a report that gets rate_limited.
  • Respect is_adult: lock adult content in every list, not only in its category.
  • Channel pictures (7.6) only from nodes with thumbnails: true (and, with picture_routes, listed in the channel's pictures): on a key press only the chosen channel's, neighbours once it plays, at most 2-3 in flight; 404 means show the logo.
  • Playback reports (7.7): stalls and crashes to the node where they happened (reports: true), blocks to diagnostics; one batch per minute, nothing about healthy playback, nothing when "Send diagnostics" is off.
  • Ignore unknown fields and unknown capabilities; handle unknown codes by HTTP status.