stream8.io
Manage API keys
Developer documentation · v1

stream8.io API

Commands, Kick messages and your stream data — connected to your website.

Authentication

  1. Sign in to stream8.io, save your own workspace, then open Website API.
  2. Create a key for wingitslots.com and select only the permissions it needs.
  3. Copy the key once and save it as STREAM8_API_KEY in your other website’s server secrets.
  4. Send Authorization: Bearer <your-key> on every request.
https://www.stream8.io/api/public/v1

Keys expire in 90 days. Revoke anytime. Access is limited to the issuing owner’s workspace, not a moderator’s selected workspace. Each key allows 120 requests per minute.

Quick start

// Runs on wingitslots.com's server, NOT in a browser.
const response = await fetch('https://www.stream8.io/api/public/v1/commands/execute', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.STREAM8_API_KEY}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    eventId: 'wingit-event-0001', // unique per event; reuse on retries
    viewer: 'viewer_name',      // from your verified signed-in user
    message: '!sr Wanted Dead or a Wild'
  })
});
const result = await response.json();
if (!response.ok) throw new Error(result.error);
// result.data = { eventId, reply }

This version must be published before these production URLs are available. Creating this API does not install the connection on wingitslots.com.

Endpoint reference

Paths below are relative to the base URL. Request bodies are JSON. Unknown fields are rejected.

GET/streamstream:read

Hunts, bonuses, calculated results, guess counts, tournament and giveaway summaries, scene names. No individual votes or guesses.

GET/requestsstream:read

The first 100 pending slot requests in queue order. Includes id, slot_name, status and created_at; excludes viewer identities.

GET/commandscommands:read

Configured commands including request defaults.

PUT/commandscommands:write

Create or replace one command by id. Send id, command, response, enabled, optional action and role. Does not replace other commands.

POST/commands/executecommands:execute

Execute a viewer command. Send eventId, viewer and message. Uses Everyone permissions; returns a reply without posting to chat. Supports requests, custom replies, !guess, !gtb, !over, !under, !predict, !points and !pick (Pro).

POST/chatchat:send

Post a message to your connected Kick channel. Send content (1–500 characters). Requires an enabled, connected Kick bot.

GET/timed-messagestimers:read

List up to 100 Kick timed messages, oldest first.

PUT/timed-messagestimers:write

Create or edit a timed message. Send content, every_minutes (2–1440), enabled, and id only when editing.

DELETE/timed-messagestimers:write

Delete one timed message. Send its id.

Command fields

command: ! followed by 1–30 letters, numbers, underscores or hyphens. response: up to 500 characters; placeholders include {viewer}, {game}, {hunt} and {points}. action: reply or request. role: everyone, subscriber, vip, mod or broadcaster. Maximum 100 commands. Execute accepts a viewer name up to 100 characters and a message up to 500 characters.

Scope of v1

All endpoints are listed above. Hunts, requests, scene names, tournament and giveaway summaries are read-only. Full hunt editing, OBS widget controls, account management, raw chat feeds and outgoing webhooks are not available through this API.

Responses & errors

// Success
{"data":{"eventId":"wingit-event-0001","reply":"@viewer_name Wanted Dead or a Wild added to the request queue"}}

// Error
{"error":"forbidden"}
200 / 201
Success / created. A command reply may be null when a closed-requests reply is disabled.
400 / 413
Invalid input / request body larger than 4 KB.
401
Missing, invalid, expired or revoked key.
403
Missing permission, Pro required or unsupported browser request.
404
Unknown endpoint, workspace or timed message.
409
Conflicting command, unavailable Kick bot or event still processing.
429
Key rate limit reached; wait 60 seconds (Retry-After header).
503
Connection or processing failure. Read the error before retrying.

Command events are deduplicated by eventId across a workspace. Repeat identical input with the same eventId to retrieve its saved response. Different input using the same id returns 409. An incomplete event remains blocked to prevent double awards; do not retry it with a new id. Chat posts and timed-message creation are not idempotent: do not automatically retry them after an uncertain response.

Security & viewer commands

  • Use a server-to-server connection. No browser CORS access is enabled; never expose a key in public JavaScript.
  • Your website must authenticate viewers and derive their names from its own trusted accounts. Rate-limit each viewer and protect against replay or impersonation before forwarding commands.
  • API command execution always uses Everyone permissions; requests cannot claim streamer or moderator roles. Existing command switches, closed-request behaviour and game matching still apply.
  • Command execution returns the reply; it does not send it to Kick or Discord. Kick posting uses the separate chat endpoint. Discord slash commands remain a separate verified integration.
  • Viewer commands can award points and enter guesses, predictions or tournament picks. Only issue commands:execute to a trusted server.
  • API reads exclude member records, account credentials, individual votes, individual balance guesses, private OBS backgrounds and support tickets.
  • Keep write permissions off unless your website needs them. Replace expiring keys and revoke unused access promptly.
  • Kick timed messages post whether or not the channel is live, through the existing scheduler.