Overview
The demo is a small, unbranded PHP app that a partner drops into their own site. Everything runs server-side: the browser never sees a token. The whole integration is four steps.
Connect
Send the user to BentBox's consent screen with your client_id, requested scopes, and a CSRF state.
Approve
The user signs in to BentBox and approves. BentBox redirects back to your redirect_uri with a short-lived code.
Exchange
Your server swaps the code plus your client_secret for an access_token and connection_id, and stores them encrypted.
Upload
Create video metadata, request a presigned URL, and upload the file bytes.
Phase A · Connecting an account
The OAuth handshake. Steps 1–5 are browser redirects; the sensitive exchange in step 6 happens server-to-server, so your client_secret is never exposed.
GET connect.php kicks it off and GET callback.php receives the return; the token exchange is a POST to /oauth/token.
⚠ redirect_uri must match exactly
The redirect_uri you send must be registered on your BentBox account character-for-character — same scheme, host, and path, no trailing slash. A mismatch returns invalid_client.
Phase B · Uploading a video
With the stored token, uploading is two API calls plus the file transfer. The token rides in both the request body and an Authorization: Bearer header.
POST /v1/content/video reserves a video_id, POST /v1/content/upload-url returns a presigned URL, and a PUT sends the bytes. In proxy mode the PUT runs on your server instead of the browser.
The POST /v1/content/video body also carries the consent attestation — sole_performer: true or a ProntoID release_form_id covering additional performer(s) — plus an optional publish_on_ready flag (default true) controlling whether BentBox publishes the video once processing and approval complete. These are fields on the existing call, so the sequence above doesn't change.
The files
Nine files, no dependencies. Download individually below, or grab everything at once.
Whole package — ready to drop into your web root.
↓ Download all (.zip) Zip unavailable on this server — download files individually.Setup
Copy the folder into your web root
Serve it over HTTPS — OAuth and secure cookies require it.
Register your redirect URI
Add the exact URL of callback.php to your BentBox redirect_uris.
Generate a cookie key
Use the same value on every server.
Fill in config.php
Credentials, redirect URI, scopes, and the key — then open index.php.
php -r "echo base64_encode(random_bytes(32)).PHP_EOL;"
🔑 One key, every instance
The cookie key encrypts the stored tokens. Behind a load balancer, all nodes must share the identical key, or a connection written by one node won't decrypt on another.