API reference

The full API reference lives on Postman. It covers every endpoint (organizations, videos, collections, members, webhooks, employer branding), the request-signing scheme, and worked request/response examples.

What's covered

• Authentication: api_key + api_secret, plus the Signature header derived per request
• Organizations, members, user resources
• Videos: list, read, delete (plus the deprecated v0 endpoints)
• Collections: create, read, update, delete, secure_mode flag, delete_after_days retention
• Employer branding: pages, videos, delete
• Webhooks: subscribe to events on your account

Request signing in short

Every authenticated API request includes an Authorization header in the form `Signature <api_key>:<signature>`. The signature is a HMAC-SHA256 of a canonical StringToSign that combines the HTTP method, the URI-encoded path, the date, and the request body. The full algorithm and worked examples are in the Postman reference under Authentication.

# Conceptual shape of the request
GET /api/organizations/<org_id>/videos HTTP/1.1
Host: app.flipbase.com
Date: 2026-05-21T10:00:00Z
Authorization: Signature <api_key>:<base64_hmac_sha256_of_StringToSign>

For player.js with secure-mode collections, the same scheme produces a per-video signature passed to the player's signature option. See the Player page for the embed pattern.

Need credentials?

API credentials (api_key, api_secret, sandbox organization) are issued per partner. Send a short request and we'll reply within one working day.