Source Pool API

The pool hands live, health-checked streaming credentials to approved clients. Keys are free — create an account, request a key, and pass it as a Bearer token.

1 · Request an API key

Create an account (username + password — no email needed).
Open your dashboard and press “Request API key”.
Copy the key when it is shown. It is displayed exactly once — we store only a hash.

2 · Use the key

Send it as a Bearer token (an x-api-key header also works). Query-string keys are rejected by convention — they leak into logs.

curl -H "Authorization: Bearer atp_YOUR_KEY" \
  https://archivepool.vercel.app/api/sources

# A healthy response (credentials arrive as ciphertext):
{
  "version": 1,
  "encrypted": true,
  "tidal": {
    "apis":    [ { "id": 12, "premium": true, "status": "alive", ... } ],
    "accounts": [ ... ]
  },
  "qobuz":   { "apis": [...], "accounts": [...] },
  "deezer":  { "apis": [...], "accounts": [...] }
}

3 · Endpoints

GET/api/sourcesAPI key — always required

The credential feed consumed by the ArchiveTune app. Leases a small rotating slice of live sources per service (least-recently-used), so a leaked key exposes a handful of entries, not the whole pool. Sensitive fields are AES-256-GCM ciphertext the app decrypts locally.

GET/api/statuspublic

Aggregate, credential-free health per category (alive/dead/premium counts, uptime) plus a daily pass-rate history for the window the health log retains. This is what the home page renders.

GET/api/discovery/tidalAPI key when read-key enforcement is on

Public instance base URLs for one service (no account secrets). Same shape for /api/discovery/qobuz.

Rules of the pool

Keys are free, personal and revocable — don’t share them. Revoked keys stop working immediately.
Keep a maximum of 10 active keys per account.
The credential feed rotates: each call leases a few entries per service, not the whole pool.
Contributing a working source keeps the pool alive for everyone — you don’t need an account for that.

Contribute a source