Skip to content
StreamerCatalyst Docs

Platform — API endpoints

Base domain

Section titled “Base domain”
  • https://streamercatalyst.com

Everything on this page is reached at https://streamercatalyst.com, which the web Worker forwards to the platform Worker verbatim, so the dashboard calls it same-origin. The platform Worker’s own hostname, admin.streamercatalyst.com, serves only the admin console, behind Cloudflare Access.

Endpoints

Section titled “Endpoints”
Path Method Auth Description
/auth/login GET Public Twitch OAuth entry point — redirects to Twitch consent screen.
/auth/callback GET Public OAuth callback — exchanges code for token and creates session.
/auth/logout GET Session cookie Clears the session cookie.
/r/:code GET Public Referral link: sets a 30-day referral cookie and redirects to the home page. A channel that signs up through it gets a 14-day first trial.
/billing/* GET/POST Session cookie Billing page, plan checkout, in-place plan switch (/billing/switch), and the Stripe customer portal. The channel owner’s own session only.
/stripe/webhook POST Stripe HMAC signature Stripe billing webhook receiver (HMAC-verified); the only writer of a channel’s plan.
/api/me GET Session cookie Current user identity (proxied via web Worker).
/api/feedback POST Public Feedback submission endpoint (rate-limited; CORS-open to all module origins).
/api/notifications GET Session cookie Unread notification count and list.
/api/notifications/read POST Session cookie Marks notifications as read.
/api/channels/* * Session cookie Channel config, Twitch scope status, EventSub health, moderators and lead mods, referrals, timezone, and navigation preferences.
/api/dashboard/* * Session cookie Dashboard layout preferences and first-load state.
/internal/me GET X-Internal-Token header Session lookup used by the web Worker proxy (internal only).
/internal/eventsub POST Service binding (internal) EventSub fan-out receiver (internal, from eventsub-router): chat, stream online, and account renames.

Auth model

Section titled “Auth model”
  • Session cookie endpoints require an active StreamerCatalyst session (set at login via the platform Worker). A channel-scoped route (/api/channels/:id/…) answers only for the session’s own channel, and a read-only admin masquerade may read but not change anything.
  • Public endpoints require no authentication.
  • Signature-verified endpoints accept only requests signed by Stripe; anything unsigned or altered is refused.
  • Service binding endpoints are for other StreamerCatalyst Workers, called over Cloudflare service bindings with a shared internal token. They are not a public API.