Developers – Public API, Embeds & oEmbed

API Keys

self-serve

Create personal keys to authenticate requests. Authenticated calls get a higher rate limit (600 req/min) and per-key usage tracking.

Public Read-Only API

All endpoints return JSON, are publicly readable, cached for 60 seconds, and rate-limited to 60 requests per minute per IP. No key required during beta.

GET /v1/creators/:tag

Returns a creator's public profile and trust summary (cleared receipts, average proof score).

curl https://urxyoqimdiobnzbzkfft.supabase.co/functions/v1/public-api/v1/creators/founder

GET /v1/leaderboard?limit=25

Top creators ranked by total cleared receipts. Max limit = 100.

curl https://urxyoqimdiobnzbzkfft.supabase.co/functions/v1/public-api/v1/leaderboard?limit=10

GET /v1/posts/:id

Public-visibility GFusionTV video metadata + author. 404 for private/unready content.

curl https://urxyoqimdiobnzbzkfft.supabase.co/functions/v1/public-api/v1/posts/<video-uuid>

GET /v1/health

Service heartbeat. Use for uptime monitoring.

curl https://urxyoqimdiobnzbzkfft.supabase.co/functions/v1/public-api/v1/health

oEmbed & Link Unfurls

oembed.com

Paste a GlobaX creator or video URL into any oEmbed-aware tool (WordPress, Discord, Slack, Notion). Discovery is auto-wired via <link rel="alternate">.

Endpoint

https://urxyoqimdiobnzbzkfft.supabase.co/functions/v1/oembed?url=https%3A%2F%2Fglobax-social-fusion.com%2Fu%2Ffounder&format=json&maxwidth=600

Supported URL patterns:

https://globax-social-fusion.com/u/:tag — creator card
https://globax-social-fusion.com/gfusiontv/:id — video

Verified Creator Badge

Embed a 600×120 PNG anywhere — site, blog, email signature.

<img src="https://urxyoqimdiobnzbzkfft.supabase.co/functions/v1/embed-badge?tag=founder" alt="Verified on GlobaX" width="600" height="120" />

Partner Webhooks

HMAC-SHA256

Approved partners receive signed POSTs for receipt events (receipt.created, receipt.transitioned). Each delivery is HMAC-signed with your endpoint's signing_secret; verify before trusting payloads.

Verify a webhook signature

// Node example
import { createHmac, timingSafeEqual } from "node:crypto";
const sig = req.headers["x-globax-signature"]; // hex
const expected = createHmac("sha256", SIGNING_SECRET).update(req.rawBody).digest("hex");
if (!timingSafeEqual(Buffer.from(sig, "hex"), Buffer.from(expected, "hex"))) {
  return res.status(401).end();
}

Partner onboarding is invite-only during beta. Email partners@globax-social-fusion.com to request access.

Limits & Status

Rate limit: 60 req / min / IP on the public API.
Cache: 60s public CDN cache on successful responses.
oEmbed cache: 5 min.
Stage: v0 Beta — endpoints stable, breaking changes announced 30 days ahead.

Live health check