---
title: "Streaming API v2: Checklist"
description: "Everything a well-behaved app does, in one list."
---

- The API key is only in the gateway; the app only knows the gateway's URL.
- Store the session token and `playback_key` in secure storage; never the
  password.
- On start: `refresh-session`, then `playback-routes`.
- Branch on `code`. `session_expired` → `refresh-session` once; other `401` →
  sign in again; `403` → show it and keep the session.
- Build playback tokens with the panel's clock (`server_time`).
- Never retry a `401`, `403` or `429` in a loop. Repeated failures get the IP
  blocked.
- Report history on pause, stop and end, and at most every 2 minutes while
  playing; channels once after ~30 s. Drop a report that gets
  `rate_limited`.
- Respect `is_adult`: lock adult content in every list, not only in its
  category.
- Channel pictures (7.6) only from nodes with `thumbnails: true` (and, with
  `picture_routes`, listed in the channel's `pictures`): on a key
  press only the chosen channel's, neighbours once it plays, at most 2-3 in
  flight; `404` means show the logo.
- Playback reports (7.7): stalls and crashes to the node where they
  happened (`reports: true`), blocks to `diagnostics`; one batch per minute,
  nothing about healthy playback, nothing when "Send diagnostics" is off.
- Ignore unknown fields and unknown capabilities; handle unknown codes by
  HTTP status.