Sign in

POST /api/v2/login
Content-Type: application/x-www-form-urlencoded

username=line1234&password=secret&device_name=LG%20webOS%2C%20Living%20room

device_name is optional (up to 64 characters). The reseller sees it in the line's device list. When a phone signs in a TV, send the TV's name.

{
  "session_token": "eyJpdi…",
  "session_id": "wSN7wDGh2fH4o6Ai1LxUAg",
  "playback_key": "AbCdEfGhIjKlMnOpQrStUv",
  "exp_user": "2027-01-15T00:00:00Z",
  "exp_token": "2026-08-13T10:00:00Z",
  "server_time": 1755079200
}
Field
session_token Send it as Authorization: Bearer <session_token>. Opaque: do not parse it
session_id Identifies this device. It stays the same across renewals
playback_key base64url, 16 bytes. Builds playback tokens (section 7). Never show it
exp_user When the line expires, or null if it never does
exp_token When this session token expires (48 h at most)
server_time The panel's clock, unix seconds (section 7.3)

Errors: missing_credentials, invalid_credentials, account_disabled, account_expired, restreamer_not_allowed, invalid_api_key. A line that this key does not serve gets invalid_credentials, like a wrong password.

Store session_token, session_id and playback_key in secure storage (Keychain, Android Keystore). Never store the password: the session token is enough, because it renews itself for 90 days.

Keep it fresh: refresh-session

POST /api/v2/refresh-session
Authorization: Bearer <session_token>

It returns the same body as login. Replace the stored token and playback_key (the session_id does not change). Call it:

  • when the app starts, before anything else;
  • every ~15 minutes while the app is open (it picks up package and expiry changes);
  • once, after a session_expired from any other endpoint.

refresh-session accepts an expired session token as long as it was issued less than 90 days ago, so a TV that stayed off for weeks signs itself back in. Everything is checked again: the device was not unlinked, the line's credentials did not change, the line is active and the key is valid.

  • 401 (session_invalid, session_revoked, credentials_changed, account_not_found): the device is no longer linked. Delete the stored session and sign in or pair again.
  • 403 (account_expired, account_disabled, access_denied, …): show the message and keep the stored session. Once the line is fixed or the block lifts, the next refresh-session works without signing in again. Do not retry right away: try again on the next app start or after a few minutes.
  • No code (429, 5xx, an HTML page): temporary. Keep the session and retry with backoff.

refresh-session itself never answers session_expired.

Sign out

  • POST /api/v2/logout: signs out this device. Delete the stored session even if the call fails.
  • POST /api/v2/logout-all: signs out every device of the line.

Both answer {"message": "…"}.

Several devices of the same line can be signed in at once. The line's connection limit applies to what is playing, not to sessions.

Revocation

A session stops working when the device is signed out or unlinked by the reseller, when the line's password or username changes, or after logout-all. The API sees it within 60 seconds. The reseller can also cut connections from the panel.