Tipping — API endpoints

Base domain

• https://tips.streamercatalyst.com

The public tip page and its checkout are served on the apex domain, https://streamercatalyst.com/tip/<login>, which the web Worker forwards here. The old tips.streamercatalyst.com/tip/<login> address redirects there.

The StreamerCatalyst dashboard calls the session endpoints same-origin through https://streamercatalyst.com/m/tipping/* (for example /m/tipping/api/channels/:id/config reaches /api/channels/:id/config here). That proxy forwards the session cookie over a Cloudflare service binding and never forwards /internal/*.

Endpoints

Path	Method	Auth	Description
/tip/:login	GET	Public	The public tip page, at streamercatalyst.com/tip/<login>.
/tip/checkout	POST	Public	Starts a Stripe Checkout for a tip from the tip page. Turnstile-verified and rate-limited per IP.
/tip/auth/*	GET	Public	Optional “tip as your Twitch account” sign-in (start, callback): an identity-only Twitch OAuth with no scopes, bound into a signed token and never a session.
/webhooks/stripe	POST	Stripe HMAC signature	Stripe payment webhook: a tip settles, is refunded, or is disputed.
/webhooks/stripe-connect	POST	Stripe HMAC signature	Stripe Connect webhook: changes to a streamer’s payout account.
/api/channels/:id/config	GET/PUT	Session cookie	Tipping settings, including amount limits and anonymity. Any channel session may read; saving needs the broadcaster or a Lead Mod.
/api/channels/:id/tips	GET	Session cookie	Paginated tip ledger (?status=&limit=&cursor=). Carries no payer personal data, and anonymous tips carry no name.
/api/channels/:id/tips/summary	GET	Session cookie	Settled totals for today, 7 days and 30 days, plus the active goal.
/api/channels/:id/tips/held	GET	Session cookie	Tip messages held for approval.
/api/channels/:id/tips/:tipId/approve	POST	Session cookie	Release a held message to alerts and chat (broadcaster or Lead Mod).
/api/channels/:id/tips/:tipId/reject	POST	Session cookie	Suppress a held message; the tip still counts toward totals and the goal (broadcaster or Lead Mod).
/api/channels/:id/tips/manual	POST	Session cookie	Record an off-platform tip by hand (broadcaster or Lead Mod).
/api/channels/:id/goals	GET/POST	Session cookie	Donation goals (active, archived, and recent adjustments), or create one. One goal is active per channel.
/api/channels/:id/goals/:goalId	PATCH	Session cookie	Edit, activate, or deactivate a goal.
/api/channels/:id/goals/:goalId/archive	POST	Session cookie	Freeze a goal.
/api/channels/:id/goals/:goalId/adjustments	POST	Session cookie	Credit an off-platform amount to a goal (a signed delta). A positive one is also announced as a tip unless announce: false.
/api/channels/:id/connect/onboard	POST	Session cookie	Create or resume the Stripe Connect payout account; returns a Stripe onboarding link.
/api/channels/:id/connect/status	GET	Session cookie	Payout-account status: eligibility, whether charges and payouts are enabled, what Stripe still needs, and recent payouts.
/api/channels/:id/connect/disconnect	POST	Session cookie	Unlink the payout account; tips already in flight still settle.
/internal/widget-data	POST	Service binding (internal)	Active donation-goal progress for the goal widget (internal).
/internal/tips/*	GET/POST	Service binding (internal)	Disputed-tip queue and refunds for the admin console (internal).

Auth model

• Session cookie endpoints require an active StreamerCatalyst session (set at login via the platform Worker). A channel-scoped route (/api/channels/:id/…) answers only for the session’s own channel, and a read-only admin masquerade may read but not change anything.
• Public endpoints require no authentication.
• Signature-verified endpoints accept only requests signed by Stripe; anything unsigned or altered is refused.
• Service binding endpoints are for other StreamerCatalyst Workers, called over Cloudflare service bindings with a shared internal token. They are not a public API.