Auth - Subscriber

Base URL: https://your-domain.com

Authentication endpoints for Subscribers (mobile app). Returns a Bearer token.

API token rules

Lifetime: 30 days from login or refresh (server-configurable with API_SUBSCRIBER_TOKEN_DAYS). The exact moment is in data.expires_at (server time).
Refreshing rotates the token. POST /api/v1/subscriber/refresh-token returns a new token and revokes the old one — overwrite what you stored.
Logout / Logout All Devices revoke tokens immediately.
An expired or revoked token cannot be refreshed — the request gets 401 Unauthenticated.; log in again.
Login is rate-limited to 5 attempts per minute per username + IP.

Property	Value
Endpoint	Subscriber Login
Method	POST
URL	`/api/v1/subscriber/login`
Authentication	Not Required

Request Headers:

Header	Value	Required
`Content-Type`	`application/json`	Yes
`Accept`	`application/json`	Yes

Request Body:

json

{
    "username": "subscriber1",
    "password": "subscriber-password"
}

Parameter	Type	Required	Description
`username`	string	Yes	Subscriber's username
`password`	string	Yes	Subscriber's password

Success Response (200 OK):

json

{
    "success": true,
    "message": "Login successful",
    "data": {
        "subscriber": {
            "id": 1,
            "username": "subscriber1",
            "fullname": "John Doe",
            "email": "[email protected]",
            "phone": "01712345678",
            "package_name": "10MB Package",
            "expiration_date": "2025-12-31 23:59:59",
            "status": "active"
        },
        "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
        "token_type": "bearer",
        "expires_in": 2592000
    }
}

Error Response (401 Unauthorized):

json

{
    "success": false,
    "message": "Invalid username or password"
}

Error Response (403 Forbidden):

json

{
    "success": false,
    "message": "Your account is disabled. Please contact support."
}

Code Examples:

bash

curl -X POST "https://your-domain.com/api/v1/subscriber/login" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "subscriber1",
    "password": "subscriber-password"
  }'

php

<?php

require 'vendor/autoload.php';

use GuzzleHttp\Client;

$client = new Client(['base_uri' => 'https://your-domain.com']);

$response = $client->request('POST', '/api/v1/subscriber/login', [
    'headers' => [
        'Accept'        => 'application/json',
    ],
    'json' => [
        'username' => 'subscriber1',
        'password' => 'subscriber-password',
    ],
]);

$data = json_decode($response->getBody(), true);
print_r($data);

javascript

const BASE_URL = 'https://your-domain.com';

const response = await fetch(`${BASE_URL}/api/v1/subscriber/login`, {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    username: 'subscriber1',
    password: 'subscriber-password',
  }),
});

const data = await response.json();
console.log(data);

python

import requests

BASE_URL = "https://your-domain.com"

response = requests.post(
    f"{BASE_URL}/api/v1/subscriber/login",
    headers={
        "Accept": "application/json",
    },
    json={
        "username": "subscriber1",
        "password": "subscriber-password",
    },
)

data = response.json()
print(data)

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
)

const baseURL = "https://your-domain.com"

func main() {
	endpoint := baseURL + "/api/v1/subscriber/login"

	payload, _ := json.Marshal(map[string]any{
		"username": "subscriber1",
		"password": "subscriber-password",
	})
	req, _ := http.NewRequest("POST", endpoint, bytes.NewBuffer(payload))
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/json")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	body, _ := io.ReadAll(resp.Body)
	fmt.Println(resp.StatusCode, string(body))
}

rust

use reqwest::Client;
use serde_json::json;

const BASE_URL: &str = "https://your-domain.com";

#[tokio::main]
async fn main() -> Result<(), reqwest::Error> {
    let client = Client::new();

    let response = client
        .post(format!("{BASE_URL}/api/v1/subscriber/login"))
        .header("Accept", "application/json")
        .json(&json!({
            "username": "subscriber1",
            "password": "subscriber-password"
        }))
        .send()
        .await?;

    let data: serde_json::Value = response.json().await?;
    println!("{data:#}");
    Ok(())
}

Subscriber Logout

Logout subscriber from the current device and invalidate the token.

Property	Value
Endpoint	Subscriber Logout
Method	POST
URL	`/api/v1/subscriber/logout`
Authentication	Bearer Token (Subscriber)

Request Headers:

Header	Value	Required
`Accept`	`application/json`	Yes
`Authorization`	`Bearer subscriber-token`	Yes

Request Body: None

Success Response (200 OK):

json

{
    "success": true,
    "message": "Successfully logged out"
}

Error Response (401 Unauthorized):

json

{
    "success": false,
    "message": "Unauthenticated"
}

Code Examples:

bash

curl -X POST "https://your-domain.com/api/v1/subscriber/logout" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer your-auth-token"

php

<?php

require 'vendor/autoload.php';

use GuzzleHttp\Client;

$client = new Client(['base_uri' => 'https://your-domain.com']);

$response = $client->request('POST', '/api/v1/subscriber/logout', [
    'headers' => [
        'Accept'        => 'application/json',
        'Authorization' => 'Bearer your-auth-token',
    ],
]);

$data = json_decode($response->getBody(), true);
print_r($data);

javascript

const BASE_URL = 'https://your-domain.com';
const TOKEN = 'your-auth-token';

const response = await fetch(`${BASE_URL}/api/v1/subscriber/logout`, {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: `Bearer ${TOKEN}`,
  },
});

const data = await response.json();
console.log(data);

python

import requests

BASE_URL = "https://your-domain.com"
TOKEN = "your-auth-token"

response = requests.post(
    f"{BASE_URL}/api/v1/subscriber/logout",
    headers={
        "Accept": "application/json",
        "Authorization": f"Bearer {TOKEN}",
    },
)

data = response.json()
print(data)

package main

import (
	"fmt"
	"io"
	"net/http"
)

const baseURL = "https://your-domain.com"
const token = "your-auth-token"

func main() {
	endpoint := baseURL + "/api/v1/subscriber/logout"

	req, _ := http.NewRequest("POST", endpoint, nil)
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Authorization", "Bearer "+token)

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	body, _ := io.ReadAll(resp.Body)
	fmt.Println(resp.StatusCode, string(body))
}

rust

use reqwest::Client;

const BASE_URL: &str = "https://your-domain.com";
const TOKEN: &str = "your-auth-token";

#[tokio::main]
async fn main() -> Result<(), reqwest::Error> {
    let client = Client::new();

    let response = client
        .post(format!("{BASE_URL}/api/v1/subscriber/logout"))
        .header("Accept", "application/json")
        .bearer_auth(TOKEN)
        .send()
        .await?;

    let data: serde_json::Value = response.json().await?;
    println!("{data:#}");
    Ok(())
}

Subscriber Logout All Devices

Logout subscriber from all devices by invalidating all active tokens.

Property	Value
Endpoint	Subscriber Logout All Devices
Method	POST
URL	`/api/v1/subscriber/logout-all`
Authentication	Bearer Token (Subscriber)

Request Headers:

Header	Value	Required
`Accept`	`application/json`	Yes
`Authorization`	`Bearer subscriber-token`	Yes

Request Body: None

Success Response (200 OK):

json

{
    "success": true,
    "message": "Successfully logged out from all devices"
}

Error Response (401 Unauthorized):

json

{
    "success": false,
    "message": "Unauthenticated"
}

Code Examples:

bash

curl -X POST "https://your-domain.com/api/v1/subscriber/logout-all" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer your-auth-token"

php

<?php

require 'vendor/autoload.php';

use GuzzleHttp\Client;

$client = new Client(['base_uri' => 'https://your-domain.com']);

$response = $client->request('POST', '/api/v1/subscriber/logout-all', [
    'headers' => [
        'Accept'        => 'application/json',
        'Authorization' => 'Bearer your-auth-token',
    ],
]);

$data = json_decode($response->getBody(), true);
print_r($data);

javascript

const BASE_URL = 'https://your-domain.com';
const TOKEN = 'your-auth-token';

const response = await fetch(`${BASE_URL}/api/v1/subscriber/logout-all`, {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: `Bearer ${TOKEN}`,
  },
});

const data = await response.json();
console.log(data);

python

import requests

BASE_URL = "https://your-domain.com"
TOKEN = "your-auth-token"

response = requests.post(
    f"{BASE_URL}/api/v1/subscriber/logout-all",
    headers={
        "Accept": "application/json",
        "Authorization": f"Bearer {TOKEN}",
    },
)

data = response.json()
print(data)

package main

import (
	"fmt"
	"io"
	"net/http"
)

const baseURL = "https://your-domain.com"
const token = "your-auth-token"

func main() {
	endpoint := baseURL + "/api/v1/subscriber/logout-all"

	req, _ := http.NewRequest("POST", endpoint, nil)
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Authorization", "Bearer "+token)

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	body, _ := io.ReadAll(resp.Body)
	fmt.Println(resp.StatusCode, string(body))
}

rust

use reqwest::Client;

const BASE_URL: &str = "https://your-domain.com";
const TOKEN: &str = "your-auth-token";

#[tokio::main]
async fn main() -> Result<(), reqwest::Error> {
    let client = Client::new();

    let response = client
        .post(format!("{BASE_URL}/api/v1/subscriber/logout-all"))
        .header("Accept", "application/json")
        .bearer_auth(TOKEN)
        .send()
        .await?;

    let data: serde_json::Value = response.json().await?;
    println!("{data:#}");
    Ok(())
}

Subscriber Refresh Token

Refresh the subscriber's access token to extend the session.

Property	Value
Endpoint	Subscriber Refresh Token
Method	POST
URL	`/api/v1/subscriber/refresh-token`
Authentication	Bearer Token (Subscriber)

Request Headers:

Header	Value	Required
`Accept`	`application/json`	Yes
`Authorization`	`Bearer subscriber-token`	Yes

Request Body: None

Success Response (200 OK):

json

{
    "success": true,
    "data": {
        "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
        "token_type": "bearer",
        "expires_in": 2592000
    }
}

Error Response (401 Unauthorized):

json

{
    "success": false,
    "message": "Token has expired and cannot be refreshed"
}

Code Examples:

bash

curl -X POST "https://your-domain.com/api/v1/subscriber/refresh-token" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer your-auth-token"

php

<?php

require 'vendor/autoload.php';

use GuzzleHttp\Client;

$client = new Client(['base_uri' => 'https://your-domain.com']);

$response = $client->request('POST', '/api/v1/subscriber/refresh-token', [
    'headers' => [
        'Accept'        => 'application/json',
        'Authorization' => 'Bearer your-auth-token',
    ],
]);

$data = json_decode($response->getBody(), true);
print_r($data);

javascript

const BASE_URL = 'https://your-domain.com';
const TOKEN = 'your-auth-token';

const response = await fetch(`${BASE_URL}/api/v1/subscriber/refresh-token`, {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: `Bearer ${TOKEN}`,
  },
});

const data = await response.json();
console.log(data);

python

import requests

BASE_URL = "https://your-domain.com"
TOKEN = "your-auth-token"

response = requests.post(
    f"{BASE_URL}/api/v1/subscriber/refresh-token",
    headers={
        "Accept": "application/json",
        "Authorization": f"Bearer {TOKEN}",
    },
)

data = response.json()
print(data)

package main

import (
	"fmt"
	"io"
	"net/http"
)

const baseURL = "https://your-domain.com"
const token = "your-auth-token"

func main() {
	endpoint := baseURL + "/api/v1/subscriber/refresh-token"

	req, _ := http.NewRequest("POST", endpoint, nil)
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Authorization", "Bearer "+token)

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	body, _ := io.ReadAll(resp.Body)
	fmt.Println(resp.StatusCode, string(body))
}

rust

use reqwest::Client;

const BASE_URL: &str = "https://your-domain.com";
const TOKEN: &str = "your-auth-token";

#[tokio::main]
async fn main() -> Result<(), reqwest::Error> {
    let client = Client::new();

    let response = client
        .post(format!("{BASE_URL}/api/v1/subscriber/refresh-token"))
        .header("Accept", "application/json")
        .bearer_auth(TOKEN)
        .send()
        .await?;

    let data: serde_json::Value = response.json().await?;
    println!("{data:#}");
    Ok(())
}

WebView auto-login endpoint used by mobile app to authenticate WebView sessions automatically.

Property	Value
Endpoint	Mobile Auto Login
Method	GET
URL	`/mobile-auto-login`
Authentication	Bearer Token (Subscriber)

Request Headers:

Header	Value	Required
`Accept`	`application/json`	Yes
`Authorization`	`Bearer subscriber-token`	Yes

Request Body: None

Success Response (200 OK):

Redirects to the subscriber portal with an authenticated session.

Error Response (401 Unauthorized):

json

{
    "success": false,
    "message": "Unauthenticated"
}

Code Examples:

bash

curl -X GET "https://your-domain.com/mobile-auto-login" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer your-auth-token"

php

<?php

require 'vendor/autoload.php';

use GuzzleHttp\Client;

$client = new Client(['base_uri' => 'https://your-domain.com']);

$response = $client->request('GET', '/mobile-auto-login', [
    'headers' => [
        'Accept'        => 'application/json',
        'Authorization' => 'Bearer your-auth-token',
    ],
]);

$data = json_decode($response->getBody(), true);
print_r($data);

javascript

const BASE_URL = 'https://your-domain.com';
const TOKEN = 'your-auth-token';

const response = await fetch(`${BASE_URL}/mobile-auto-login`, {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: `Bearer ${TOKEN}`,
  },
});

const data = await response.json();
console.log(data);

python

import requests

BASE_URL = "https://your-domain.com"
TOKEN = "your-auth-token"

response = requests.get(
    f"{BASE_URL}/mobile-auto-login",
    headers={
        "Accept": "application/json",
        "Authorization": f"Bearer {TOKEN}",
    },
)

data = response.json()
print(data)

package main

import (
	"fmt"
	"io"
	"net/http"
)

const baseURL = "https://your-domain.com"
const token = "your-auth-token"

func main() {
	endpoint := baseURL + "/mobile-auto-login"

	req, _ := http.NewRequest("GET", endpoint, nil)
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Authorization", "Bearer "+token)

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	body, _ := io.ReadAll(resp.Body)
	fmt.Println(resp.StatusCode, string(body))
}

rust

use reqwest::Client;

const BASE_URL: &str = "https://your-domain.com";
const TOKEN: &str = "your-auth-token";

#[tokio::main]
async fn main() -> Result<(), reqwest::Error> {
    let client = Client::new();

    let response = client
        .get(format!("{BASE_URL}/mobile-auto-login"))
        .header("Accept", "application/json")
        .bearer_auth(TOKEN)
        .send()
        .await?;

    let data: serde_json::Value = response.json().await?;
    println!("{data:#}");
    Ok(())
}

Auth - Subscriber ​

Subscriber Login ​

Subscriber Logout ​

Subscriber Logout All Devices ​

Subscriber Refresh Token ​

Mobile Auto Login (WebView) ​

Auth - Subscriber

Subscriber Login

Subscriber Logout

Subscriber Logout All Devices

Subscriber Refresh Token

Mobile Auto Login (WebView)