Developer API

# 1. Is the live running? ("current" = the live on air now)
curl -s https://v3.aseacast.com/api/v1/sessions/current -H "Authorization: Bearer $GLP_KEY"

# 2. Push a viewer comment from your platform
curl -s -X POST https://v3.aseacast.com/api/v1/sessions/current/events \
  -H "Authorization: Bearer $GLP_KEY" -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-page-1001" \
  -d '{"id":"c-1001","platform":{"id":"myshop","name":"MyShop"},
       "user":{"id":"u42","name":"Aina"},"text":"Berapa harga saiz L?"}'

# 3. Watch what the host says (Server-Sent Events)
curl -N https://v3.aseacast.com/api/v1/sessions/current/stream -H "Authorization: Bearer $GLP_KEY"

// Node 18+ (server side — never ship the key to a browser)
const KEY = process.env.GLP_KEY;
const API = "https://v3.aseacast.com/api/v1";

async function sendComment(sessionId, c) {
  const res = await fetch(`${API}/sessions/${sessionId}/events`, {
    method: "POST",
    headers: { Authorization: `Bearer ${KEY}`, "Content-Type": "application/json", "Idempotency-Key": c.id },
    body: JSON.stringify({ id: c.id, platform: { id: "myshop", name: "MyShop" },
                           user: { id: c.userId, name: c.userName }, text: c.text }),
  });
  if (res.status === 429) await new Promise((r) => setTimeout(r, 1000 * Number(res.headers.get("retry-after") ?? 1)));
  if (!res.ok && res.status !== 409) throw new Error((await res.json()).error.message);
  return res.json();
}

// Browser captions: your server makes a stream token, the page opens EventSource with it.
// server:  POST ${API}/sessions/<id>/stream-tokens  →  { streamUrl }
const es = new EventSource(streamUrl);
es.addEventListener("speech.start", (e) => showCaption(JSON.parse(e.data).data.text));
es.addEventListener("product.shown", (e) => pinProduct(JSON.parse(e.data).data.productId));

import os, requests

API = "https://v3.aseacast.com/api/v1"
H = {"Authorization": f"Bearer {os.environ['GLP_KEY']}"}

s = requests.get(f"{API}/sessions/current", headers=H, timeout=10).json()["session"]
print(s["status"], s["hosts"])

r = requests.post(f"{API}/sessions/{s['id']}/events", headers=H, timeout=10, json={
    "platform": {"id": "myshop", "name": "MyShop"},
    "events": [
        {"kind": "join", "user": {"name": "Ali"}},
        {"id": "c-7", "kind": "question", "user": {"name": "Siti"}, "text": "Ada warna hitam?",
         "productId": "p_tudung"},
        {"kind": "gift", "user": {"name": "Mei"}, "meta": {"giftName": "Rose", "giftValue": 10}},
    ],
})
print(r.status_code, r.json())

# Stream host events
with requests.get(f"{API}/sessions/{s['id']}/stream", headers=H, stream=True, timeout=None) as st:
    for line in st.iter_lines(decode_unicode=True):
        if line.startswith("data:"):
            print(line[5:])

{ "type": "speech.start", "id": "41", "sessionId": "cm…", "runId": "cm…", "at": "2026-10-05T09:12:03.120Z",
  "data": { "utteranceId": "u17", "text": "Saiz L harga RM39, Aina!", "hostId": "host_1", "hostName": "Salmah",
            "kind": "answer", "replyTo": { "eventId": "c-1001", "platform": "MyShop", "user": "Aina",
                                           "text": "Berapa harga saiz L?" } } }
{ "type": "speech.end",     "data": { "utteranceId": "u17", "hostId": "host_1" } }
{ "type": "product.shown",  "data": { "productId": "p_tudung", "name": "Tudung Bawal", "price": "RM39" } }
{ "type": "product.hidden", "data": { "productId": "p_tudung" } }
{ "type": "event.result",   "data": { "eventId": "c-1001", "status": "accepted" } }
{ "type": "session.started" | "session.live" | "session.ended", "data": { "mode": "live" } }

import crypto from "node:crypto";

// Use the RAW body exactly as received, before JSON.parse.
export function verify(secret, header, rawBody, toleranceS = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.trim().split("=", 2)));
  const t = Number(parts.t);
  if (!parts.v1 || Math.abs(Date.now() / 1000 - t) > toleranceS) return false;
  const expected = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  return expected.length === parts.v1.length &&
         crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}
// Express: app.post("/glp-webhook", express.raw({ type: "application/json" }), (req, res) => {
//   if (!verify(process.env.GLP_WHSEC, req.get("GLP-Signature"), req.body.toString("utf8"))) return res.sendStatus(400);
//   const { id, events } = JSON.parse(req.body);   // de-duplicate on id
//   res.sendStatus(200);
// });

import hmac, hashlib, time

def verify(secret: str, header: str, raw_body: bytes, tolerance_s: int = 300) -> bool:
    parts = dict(p.strip().split("=", 1) for p in header.split(","))
    t = int(parts.get("t", "0"))
    if "v1" not in parts or abs(time.time() - t) > tolerance_s:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts["v1"])

# Same computer as the Go Live Plus app — no internet round trip.
# The port is the app's comment bridge (first free of 47850–47859); the token is
# in Studio → Sediakan Live → Output → "Developer API (this computer)".
curl -s -X POST http://127.0.0.1:47850/dev/v1/sessions/current/events \
  -H "Authorization: Bearer $GLP_LOCAL_TOKEN" -H "Content-Type: application/json" \
  -d '{"platform":"kiosk","user":{"name":"Walk-in"},"text":"Ada stok saiz M?"}'

curl -N http://127.0.0.1:47850/dev/v1/sessions/current/stream -H "Authorization: Bearer $GLP_LOCAL_TOKEN"