Developer API

Authentication

All API requests require an API key passed in the X-API-Key / Authorization: Bearer header.

To create an API key, go to Developer Settings in your dashboard. You can have up to 5 keys.

Base URL

All endpoints return JSON. Paginated endpoints include a meta object with current_page, last_page, and total.

Streams

Categories

Users

Clips

Tournaments

ELO Rankings

Leagues

Error Responses

All errors return a consistent JSON envelope. The error object always contains a machine-readable code and a human-readable message.

Status Codes

Error Codes Reference

Rate Limits

API requests are rate-limited per API key. When you exceed the limit, requests return 429 Too Many Requests with a Retry-After header.

Limits by Tier

Rate Limit Headers

API requests are rate-limited per API key. When you exceed the limit, requests return 429 Too Many Requests with a Retry-After header.

Best Practices

Webhooks (EventSub)

Subscribe to real-time push notifications instead of polling. When an event occurs, D1Arena sends an HTTP POST to your callback URL with a JSON payload signed with HMAC-SHA256.

Setup

Create webhook subscriptions in Developer Settings. Each subscription requires:

• Callback URL — A publicly accessible HTTPS endpoint on your server.
• Events — One or more event types to subscribe to.

You'll receive a whsec_ signing secret upon creation. Store it securely — it's shown only once.

Payload Format

Every webhook delivery sends a JSON body with this structure:

Headers

Each delivery includes the following headers for routing and verification:

Verifying Signatures

Always verify the X-D1Arena-Signature header before processing a webhook. The signature is computed as HMAC-SHA256(raw_body, webhook_secret).

For v2 deliveries, use the whsec_ secret shown when the subscription was created. For a pre-upgrade v1-hashed-secret delivery, first compute SHA256(whsec_secret) from that original secret and use the resulting lowercase hex digest as the HMAC key. Recreate the subscription when practical to move to v2.

Available Events

Event Payload Examples

Delivery & Retry Policy

Best Practices

• Always verify signatures before processing payloads to prevent spoofed events.
• Use the Delivery-Id for deduplication — retries send the same ID, so store processed IDs to avoid double-processing.
• Respond quickly, process asynchronously — return 200 OK immediately and handle business logic in a background job.
• Use HTTPS endpoints only — webhook URLs must use TLS. HTTP callbacks are rejected.
• Handle unknown events gracefully — new event types may be added. Return 200 for unrecognized events rather than erroring.

D1 Frenzy

D1 Frenzy is triggered by rapid tips and subscriptions while a streamer is live. It progresses through 5 levels with increasing targets.

GET /api/overdrive/{streamerId}

Get the active D1 Frenzy for a streamer. Returns {"active": false} if none.

Level Targets

D1 Frenzy — Points: Tip $1 → 100; Subscription 500 × Tier. Duration: 5 Minutes; Cooldown: 30 Minutes.

Extension SDK

Build custom panel and overlay extensions that streamers can install on their channel pages. Extensions run in sandboxed iframes and communicate with the host page via postMessage.

Getting Started

1. Create an API key in Developer Settings.
2. Build your extension as a standalone HTML page hosted on your domain (HTTPS required).
3. Submit it for review in the My Extensions section.
4. Once approved, streamers can install it from the Extension Marketplace.

Extension Types

postMessage API

Your extension receives context data automatically when it loads. Implement these events:

Use the exact D1Arena parent origin for every message. The official SDK derives and validates this origin from the embedding page automatically.

Because extension iframes intentionally use an opaque sandbox origin, the D1Arena host authenticates the exact registered iframe window. Extension code must still authenticate the parent window and exact D1Arena origin before accepting context.

1. Signal readiness

2. Receive context

3. Send actions (optional)

Permission Scopes

Declare what data your extension needs. Reviewers verify your code matches your declared permissions.

Security Requirements

• Public HTTPS required — Your iframe URL must use TLS and resolve only to public network addresses.
• Human-readable source — No obfuscated or minified-only JavaScript. Reviewers must be able to read your code.
• No external script loading unless declared in your submission. CDN libraries (jQuery, Chart.js, etc.) are fine.
• No data exfiltration — Extensions must not send viewer data to third-party analytics or tracking services.
• Content policy — No ads, NSFW content, cryptocurrency mining, or malicious behavior.

Review Process

Version Updates

To update an approved extension, delete the current version and submit a new one with an incremented version number. The new version goes through review again.

Changelog

Track API changes and new features. We follow semantic versioning and announce breaking changes at least 30 days in advance.

Need Help?

Questions about the API? Contact us.