OAuth & Content Upload API Reference

// Step 1 — send the user to signup with your attribution params
https://bentbox.co/signup?ref=YOUR_REF_CODE&src=partnersite

// Step 2 — after signup, redirect into the OAuth flow as normal
https://api.bentbox.co/oauth/authorize?
  client_id=mp_live_abc123...&
  redirect_uri=https://yourplatform.com/callback&
  scope=upload_video,upload_photo&
  state=random_csrf_token&
  response_type=code

// Encode attribution data alongside your CSRF token
const statePayload = btoa(JSON.stringify({
  csrf:  "random_csrf_token",
  ref:   "YOUR_REF_CODE",
  src:   "partnersite"
}));

// Pass as the state parameter in your authorize redirect
https://api.bentbox.co/oauth/authorize?
  client_id=mp_live_abc123...&
  redirect_uri=https://yourplatform.com/callback&
  scope=upload_video,upload_photo&
  state={statePayload}&
  response_type=code

// On your callback, decode state to recover ref/src
const { csrf, ref, src } = JSON.parse(atob(callbackState));

// Install dependencies: npm install express axios
            const express = require('express');
            const axios = require('axios');
            const fs = require('fs');
            const crypto = require('crypto');

            const app = express();
            const sessions = new Map(); // Use Redis in production

            const BENTBOX_CONFIG = {
              clientId: 'mp_live_abc123...',
              clientSecret: 'mp_secret_xyz...',
              redirectUri: 'https://yourplatform.com/oauth/callback',
              authUrl: 'https://api.bentbox.co/oauth/authorize',
              tokenUrl: 'https://api.bentbox.co/oauth/token',
              apiBase: 'https://api.bentbox.co'
            };

            // Step 1: Initiate OAuth flow
            app.get('/connect-bentbox', (req, res) => {
              const state = crypto.randomBytes(16).toString('hex');
              sessions.set(state, { userId: req.user.id });

              const authUrl = `${BENTBOX_CONFIG.authUrl}?` +
                `client_id=${BENTBOX_CONFIG.clientId}&` +
                `redirect_uri=${encodeURIComponent(BENTBOX_CONFIG.redirectUri)}&` +
                `scope=upload_video,upload_photo&` +
                `state=${state}&` +
                `response_type=code`;

              res.redirect(authUrl);
            });

            // Step 2: Handle OAuth callback
            app.get('/oauth/callback', async (req, res) => {
              const { code, state } = req.query;

              if (!sessions.has(state)) {
                return res.status(400).send('Invalid state');
              }

              try {
                const response = await axios.post(BENTBOX_CONFIG.tokenUrl, {
                  grant_type: 'authorization_code',
                  code,
                  client_id: BENTBOX_CONFIG.clientId,
                  client_secret: BENTBOX_CONFIG.clientSecret,
                  redirect_uri: BENTBOX_CONFIG.redirectUri
                });

                const { access_token, refresh_token, connection_id, user_id } = response.data;

                // Store tokens in database (encrypted!)
                await db.saveConnection({
                  userId: sessions.get(state).userId,
                  bentboxUserId: user_id,
                  connectionId: connection_id,
                  accessToken: encrypt(access_token),
                  refreshToken: encrypt(refresh_token)
                });

                sessions.delete(state);
                res.redirect('/dashboard?connected=true');
              } catch (error) {
                console.error('Token exchange failed:', error.response?.data);
                res.status(500).send('Connection failed');
              }
            });

            // Step 3: Upload video
            app.post('/upload-video', async (req, res) => {
              const { title, description, videoPath } = req.body;
              const connection = await db.getConnection(req.user.id);
              const accessToken = decrypt(connection.accessToken);

              try {
                // Create video metadata
                const fileStats = fs.statSync(videoPath);
                const createRes = await axios.post(
                  `${BENTBOX_CONFIG.apiBase}/v1/content/video`,
                  {
                    connection_id: connection.connectionId,
                    title,
                    description,
                    filename: 'video.mp4',
                    filesize: fileStats.size,
                    tags: ['uploaded', 'from-platform']
                  },
                  { headers: { 'Authorization': `Bearer ${accessToken}` } }
                );

                const { video_id } = createRes.data;

                // Get upload URL (includes title, price, duration for validation)
                const urlRes = await axios.post(
                  `${BENTBOX_CONFIG.apiBase}/v1/content/upload-url`,
                  {
                    connection_id: connection.connectionId,
                    video_id,
                    title,
                    price: req.body.price ?? 0,
                    duration: req.body.duration,  // seconds, read from file metadata
                    description: req.body.description ?? '',
                    tags: req.body.tags ?? [],
                    adult_content: true
                  },
                  { headers: { 'Authorization': `Bearer ${accessToken}` } }
                );

                const { upload_url } = urlRes.data;

                // Upload file to S3
                const fileBuffer = fs.readFileSync(videoPath);
                await axios.put(upload_url, fileBuffer, {
                  headers: { 'Content-Type': 'video/mp4' },
                  maxContentLength: 2147483648
                });

                res.json({ success: true, video_id });
              } catch (error) {
                console.error('Upload failed:', error.response?.data);
                res.status(500).json({ 
                  success: false, 
                  error: error.response?.data?.error || 'Upload failed'
                });
              }
            });

            app.listen(3000);

# Install: pip install flask requests
            from flask import Flask, redirect, request, session
            import requests
            import secrets
            import os

            app = Flask(__name__)
            app.secret_key = os.urandom(24)

            BENTBOX_CONFIG = {
                'client_id': 'mp_live_abc123...',
                'client_secret': 'mp_secret_xyz...',
                'redirect_uri': 'https://yourplatform.com/oauth/callback',
                'auth_url': 'https://api.bentbox.co/oauth/authorize',
                'token_url': 'https://api.bentbox.co/oauth/token',
                'api_base': 'https://api.bentbox.co'
            }

            # Step 1: Initiate OAuth
            @app.route('/connect-bentbox')
            def connect_bentbox():
                state = secrets.token_urlsafe(16)
                session['oauth_state'] = state
                
                auth_url = f"{BENTBOX_CONFIG['auth_url']}?" \
                    f"client_id={BENTBOX_CONFIG['client_id']}&" \
                    f"redirect_uri={BENTBOX_CONFIG['redirect_uri']}&" \
                    f"scope=upload_video,upload_photo&" \
                    f"state={state}&" \
                    f"response_type=code"
                
                return redirect(auth_url)

            # Step 2: Handle callback
            @app.route('/oauth/callback')
            def oauth_callback():
                code = request.args.get('code')
                state = request.args.get('state')
                
                if state != session.get('oauth_state'):
                    return 'Invalid state', 400
                
                try:
                    response = requests.post(BENTBOX_CONFIG['token_url'], json={
                        'grant_type': 'authorization_code',
                        'code': code,
                        'client_id': BENTBOX_CONFIG['client_id'],
                        'client_secret': BENTBOX_CONFIG['client_secret'],
                        'redirect_uri': BENTBOX_CONFIG['redirect_uri']
                    })
                    
                    data = response.json()
                    
                    # Store in database
                    db.save_connection(
                        user_id=session['user_id'],
                        bentbox_user_id=data['user_id'],
                        connection_id=data['connection_id'],
                        access_token=encrypt(data['access_token']),
                        refresh_token=encrypt(data['refresh_token'])
                    )
                    
                    return redirect('/dashboard?connected=true')
                except Exception as e:
                    return f'Connection failed: {str(e)}', 500

            # Step 3: Upload video
            @app.route('/upload-video', methods=['POST'])
            def upload_video():
                title = request.json['title']
                video_path = request.json['video_path']
                
                connection = db.get_connection(session['user_id'])
                access_token = decrypt(connection.access_token)
                
                try:
                    # Create metadata
                    file_size = os.path.getsize(video_path)
                    metadata_response = requests.post(
                        f"{BENTBOX_CONFIG['api_base']}/v1/content/video",
                        json={
                            'connection_id': connection.connection_id,
                            'title': title,
                            'filename': 'video.mp4',
                            'filesize': file_size
                        },
                        headers={'Authorization': f'Bearer {access_token}'}
                    )
                    video_id = metadata_response.json()['video_id']
                    
                    # Get upload URL
                    url_response = requests.post(
                        f"{BENTBOX_CONFIG['api_base']}/v1/content/upload-url",
                        json={'connection_id': connection.connection_id, 'video_id': video_id},
                        headers={'Authorization': f'Bearer {access_token}'}
                    )
                    upload_url = url_response.json()['upload_url']
                    
                    # Upload file
                    with open(video_path, 'rb') as f:
                        requests.put(upload_url, data=f, headers={'Content-Type': 'video/mp4'})
                    
                    return {'success': True, 'video_id': video_id}
                except Exception as e:
                    return {'success': False, 'error': str(e)}, 500

<?php
            // Configuration
            define('CLIENT_ID', 'mp_live_abc123...');
            define('CLIENT_SECRET', 'mp_secret_xyz...');
            define('REDIRECT_URI', 'https://yourplatform.com/callback.php');
            define('API_BASE', 'https://api.bentbox.co');

            // Step 1: Initiate OAuth
            function initiateBentBoxOAuth() {
                $state = bin2hex(random_bytes(16));
                $_SESSION['oauth_state'] = $state;
                
                $params = [
                    'client_id' => CLIENT_ID,
                    'redirect_uri' => REDIRECT_URI,
                    'scope' => 'upload_video,upload_photo',
                    'state' => $state,
                    'response_type' => 'code'
                ];
                
                $authUrl = API_BASE . '/oauth/authorize?' . http_build_query($params);
                header("Location: $authUrl");
                exit;
            }

            // Step 2: Handle callback
            function handleOAuthCallback() {
                $code = $_GET['code'] ?? null;
                $state = $_GET['state'] ?? null;
                
                if ($state !== $_SESSION['oauth_state']) {
                    die('Invalid state');
                }
                
                $ch = curl_init(API_BASE . '/oauth/token');
                curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
                curl_setopt($ch, CURLOPT_POST, true);
                curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
                    'grant_type' => 'authorization_code',
                    'code' => $code,
                    'client_id' => CLIENT_ID,
                    'client_secret' => CLIENT_SECRET,
                    'redirect_uri' => REDIRECT_URI
                ]));
                curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
                
                $response = curl_exec($ch);
                $data = json_decode($response, true);
                curl_close($ch);
                
                // Store in database (encrypted!)
                saveConnection([
                    'user_id' => $_SESSION['user_id'],
                    'connection_id' => $data['connection_id'],
                    'access_token' => encrypt($data['access_token']),
                    'refresh_token' => encrypt($data['refresh_token'])
                ]);
                
                header('Location: /dashboard?connected=true');
            }

            // Step 3: Upload video
            function uploadVideo($title, $videoPath) {
                $connection = getConnection($_SESSION['user_id']);
                $accessToken = decrypt($connection['access_token']);
                
                // Create metadata
                $ch = curl_init(API_BASE . '/v1/content/video');
                curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
                curl_setopt($ch, CURLOPT_POST, true);
                curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
                    'connection_id' => $connection['connection_id'],
                    'title' => $title,
                    'filename' => 'video.mp4',
                    'filesize' => filesize($videoPath)
                ]));
                curl_setopt($ch, CURLOPT_HTTPHEADER, [
                    'Authorization: Bearer ' . $accessToken,
                    'Content-Type: application/json'
                ]);
                
                $response = json_decode(curl_exec($ch), true);
                $videoId = $response['video_id'];
                curl_close($ch);
                
                // Get upload URL
                $ch = curl_init(API_BASE . '/v1/content/upload-url');
                curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
                curl_setopt($ch, CURLOPT_POST, true);
                curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
                    'connection_id' => $connection['connection_id'],
                    'video_id'      => $videoId,
                    'title'         => $title,
                    'price'         => $price,
                    'duration'      => $duration,  // seconds, from file metadata
                    'description'   => $description,
                    'tags'          => $tags,
                    'adult_content' => true
                ]));
                curl_setopt($ch, CURLOPT_HTTPHEADER, [
                    'Authorization: Bearer ' . $accessToken,
                    'Content-Type: application/json'
                ]);
                
                $response = json_decode(curl_exec($ch), true);
                $uploadUrl = $response['upload_url'];
                curl_close($ch);
                
                // Upload to S3
                $ch = curl_init($uploadUrl);
                curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
                curl_setopt($ch, CURLOPT_PUT, true);
                curl_setopt($ch, CURLOPT_INFILE, fopen($videoPath, 'rb'));
                curl_setopt($ch, CURLOPT_INFILESIZE, filesize($videoPath));
                curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: video/mp4']);
                
                curl_exec($ch);
                $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
                curl_close($ch);
                
                return $httpCode === 200;
            }

{
  "success": false,
  "error": "invalid_grant",
  "error_description": "Authorization code has expired"
}

{
  "success": false,
  "error": "duration_exceeded",
  "error_description": "Video duration exceeds the maximum allowed length of 15 minutes.",
  "max_duration_seconds": 900,
  "declared_duration_seconds": 1240.5
}