Legal & Compliance
API Documentation
Integrate ON AIR FLOW LLC's curated instrumental music into your applications, POS systems, or internal dashboards. Delivery is playback only — the same stream/play model as the Client Portal player. Download, save, and export of source audio/visual files are not available through the API.
- Playback only — media is returned as time-limited (24h) signed stream URLs for progressive play in a player or browser.
- No permanent file links — storage keys and long-lived public Bunny/S3 paths are never returned to API clients.
- No download or export — bulk download, zip, and export endpoints are not provided and return HTTP 403 if requested.
- Refresh before expiry — stream URLs expire after 24 hours (same as Client Portal). Call POST /play again for multi-day continuous playback.
Authentication
The ON AIR FLOW LLC Client API uses organization API keys (issued on Pro, Business, and Enterprise plans). Starter plan access is Client Portal login only and does not include API keys.
Your API keys carry access to your licensed catalog stream — keep them private. Do not embed keys in public client-side code, mobile apps without a backend proxy, or public repositories.
Methods
Pass your key in the X-API-Key header.
Use Authorization: Bearer YOUR_API_KEY.
Do not put API keys in URL query strings (?api_key=). Query-string keys are deprecated, may appear in logs/referrers, and will be removed in a future release.
Endpoints
Retrieve catalog playlists for your subscription. Returns metadata only — no media URLs or storage keys.
{
"success": true,
"delivery_mode": "playback_only",
"data": [
{
"id": "clxplaylist01",
"name": "Deep Focus",
"description": "Instrumental focus beds",
"duration_seconds": 7200,
"track_count": 24,
"has_visual": true,
"visual_type": "video",
"updated_at": "2026-07-01T12:00:00.000Z"
}
],
"note": "Metadata only. Use POST /api/v1/play with a playlist_id to obtain 24h signed stream URLs."
}Track list for a playlist (titles, duration, order). Does not include stream URLs or file paths.
Start a playback-only session for a playlist. Returns time-limited signed HTTPS stream URLs for each track (and optional visual loop). Valid for 24 hours (same as Client Portal), so long playlists can play without mid-session interruption. Re-call this endpoint before expiry for multi-day continuous playback.
{
"playlist_id": "clxplaylist01",
"device_id": "pos_terminal_main"
}{
"success": true,
"mode": "playback_only",
"playlist_id": "clxplaylist01",
"playlist_name": "Deep Focus",
"device_id": "pos_terminal_main",
"expires_in": 86400,
"expires_at": "2026-07-22T12:00:00.000Z",
"stream_url": "https://…signed…/track.mp3?X-Amz-Expires=86400&…",
"tracks": [
{
"id": "clxtrack01",
"title": "Glass Corridor",
"duration": 187,
"bpm": 82,
"order": 0,
"stream_url": "https://…signed…/track.mp3?X-Amz-Expires=86400&…"
}
],
"visual": {
"type": "video",
"stream_url": "https://…signed…/visual.mp4?X-Amz-Expires=86400&…"
},
"notice": "Playback only. Stream URLs are time-limited signed links…"
}Check API operational status, your organization context, and delivery mode (playback_only).
Download and export routes are intentionally unavailable. Requests receive HTTP 403 with error: download_not_allowed.
Code Examples
curl -X GET "https://api.onairflow.store/api/v1/list_playlists" \
-H "X-API-Key: YOUR_API_KEY"curl -X POST "https://api.onairflow.store/api/v1/play" \
-H "X-API-Key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"playlist_id":"YOUR_PLAYLIST_ID","device_id":"lobby-speaker-1"}'Full SDK client libraries for Node.js and Python are available to enterprise customers upon request.
Licensing & Legal
Integrating our API into your POS systems or internal apps provides commercial cover under your active subscription, for streaming/playback use only. Redistribution, offline libraries built by bulk download, and resale of audio files are prohibited.
All tracks streamed via the API are owned entirely by ON AIR FLOW LLC. We bear all copyright responsibility.
Your active API subscription is your license. Zero reporting to ASCAP, BMI, SACEM, or other rights organizations for permitted internal use.
Want to review permitted uses and limitations? Read our complete Licensing & Legal page →
Security Best Practices
Never commit API keys to your repository. Use environment variables and secrets managers (AWS Secrets Manager, HashiCorp Vault, etc.).
Treat signed stream URLs as temporary credentials (24h). Do not log them, store them past expiry, or redistribute them. Always re-fetch via POST /play when they expire.
Rotate API keys periodically from the Admin Dashboard. Create a new key before revoking the old one for zero downtime.
Standard clients should keep request volume reasonable (e.g. playlist list + play refresh). Contact support for enterprise rate needs.
FAQ
API keys are provisioned automatically for Pro+ subscriptions (welcome package / Client Portal) and can be managed by administrators. Starter plans do not include API keys.
No. The API is playback-only, matching the Client Portal player. You may stream via time-limited (24h) signed URLs; download, export, and permanent file access are not supported.
Yes — cache playlist metadata (name, duration, track titles) for up to 24 hours. Do not cache stream URLs long-term; they expire and must be refreshed with POST /play.
Yes for delivery intent: both use signed, time-limited stream access for play. The Portal is the browser UI; this API is for server-side and device integrations with your organization API key.