challengeBrowserPlayer

POST

/api/v1/player/browser/challenge

curl --request POST \
  --url https://example.com/api/v1/player/browser/challenge \
  --header 'Content-Type: application/json' \
  --data '{ "slotId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "bindingId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" }'

Create one two-minute challenge for the current slot and binding. Rate limited; no-store.

Request Body^required

Media typeapplication/json

object

slotId

required

string format: uuid

bindingId

required

string format: uuid

Example^generated

{
  "slotId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "bindingId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
}

Responses

200

Single-use device-key challenge

Media typeapplication/json

object

data

required

object

nonce

required

string

>= 43 characters <= 43 characters

message

required

The complete text the device key signs, tilecast-browser-player-v1:<slotId>:<bindingId>:<nonce>. Signing the nonce alone is rejected.

string

expiresAt

required

string format: date-time

Example^generated

{
  "data": {
    "nonce": "example",
    "message": "example",
    "expiresAt": "2026-04-15T12:00:00Z"
  }
}

401

Binding is invalid or replaced

403

Same-origin HTTPS required

429

Rate limited