# BentBox PHP sample integration

Four PHP files that let creators on your site connect their BentBox account,
upload videos to it, and follow each video until it's live.

| File | What it does |
|---|---|
| `bentbox_config.php` | Settings, encrypted-cookie token store, and the calls to the BentBox API |
| `bentbox_connect.php` | Step 1: sends the creator to BentBox to approve your platform |
| `bentbox_callback.php` | Steps 2–3: checks the return, exchanges the code for tokens, stores them |
| `bentbox_upload.php` | Steps 4–5: upload form (create, sign, upload) and the "Your uploads" status list |

No framework, no Composer packages. Needs PHP 7.4 or later with the `curl`
and `openssl` extensions, and HTTPS.

## Setup

1. **Copy the four files** into a folder on your site, served over HTTPS.
2. **Register your redirect URI.** Send BentBox (api@bentbox.co) the full URL of
   `bentbox_callback.php`, for example `https://example.com/bentbox/bentbox_callback.php`.
3. **Set the environment variables** in your web server or PHP-FPM pool:

   | Variable | Value |
   |---|---|
   | `BENTBOX_CLIENT_ID` | Your client ID (`mp_live_…`) |
   | `BENTBOX_CLIENT_SECRET` | Your client secret (`mp_secret_…`) |
   | `BENTBOX_REDIRECT_URI` | The callback URL from step 2, exactly |
   | `BENTBOX_COOKIE_KEY` | `php -r "echo base64_encode(random_bytes(32)).PHP_EOL;"` |
   | `BENTBOX_COOKIE_DOMAIN` | Optional, e.g. `.example.com` to share across www and apex |

   With PHP-FPM, for example: `env[BENTBOX_CLIENT_ID] = mp_live_…` in the pool file.
4. **Link to `bentbox_connect.php`** from your site ("Connect BentBox").

## How it works

1. `bentbox_connect.php` stores a random `state` in an encrypted cookie and
   redirects to `https://api.bentbox.co/oauth/authorize`.
2. The creator signs in to BentBox and approves. BentBox redirects to
   `bentbox_callback.php?code=…&state=…`.
3. The callback checks `state`, then exchanges the code server to server at
   `/oauth/token` and stores the tokens in an encrypted, HttpOnly cookie.
4. On `bentbox_upload.php` the creator picks a file and says who's in it.
   Your server calls `POST /v1/content/video` and `POST /v1/content/upload-url`;
   the browser then `PUT`s the file to the presigned URL.
5. The page polls `GET /v1/content/video/{video_id}` through your server and
   shows each video's status, with a link to BentBox when the creator needs to act.

## Security notes

- Tokens, the client secret and video IDs never reach the browser. The status
  list uses encrypted references that only work for the connection that made them.
- Every server behind a load balancer must share the same `BENTBOX_COOKIE_KEY`.
  Changing it signs every creator out of BentBox on your site.
- Ask creators who appears in each video. Send `sole_performer: true` only when
  they're the only person in it; otherwise a ProntoID `release_form_id`.

Full API reference: https://api.bentbox.co/docs