API Developer Hub

1. HMAC Signed Redirect Routing

To protect streaming servers from third-party hotlinking and scrape abuses, all resolved stream URLs are passed through a local proxy resolver: /api/stream-redirect.

This router enforces a cryptographic signature signature verification protocol. The stream URL is base64url encoded, appended with an expiration timestamp, and signed using an HMAC-SHA256 signature generated with the server's secret key (STREAM_SECRET). Requests with expired timestamps or incorrect signatures are instantly blocked (returns 403 Forbidden).

2. Cache Revalidation Limits

We employ an aggressive client/server caching layer to ensure lightning-fast page loading and protect upstream services:

• Match Fixtures: Revalidates every 10 seconds to keep live scores, elapsed match minutes, and game statuses accurately synchronized.
• Server Streams: Revalidates every 15 seconds, ensuring link rotation is fast while preventing heavy concurrent query loads.
• Image Binaries: Team logos, tournament badges, and match posters are cached for 24 hours (86,400 seconds) on client browsers and local server instances.

3. Team Matching & Fuzzy Alignment

Matches are aggregated from multiple scraping channels (WatchFooty, CDNLive, etc.) in real-time. Since names differ across networks (e.g., "Manchester United" vs "Man Utd"), the backend leverages a strategy pattern orchestrator:

The engine applies fuzzy Jaro-Winkler string similarity calculations (lib/utils/matching.ts). If the similarity score is greater than 0.85, the teams are aligned, and the duplicate match entries are collapsed, creating a single unified match console.

4. Environment Configuration

To configure or customize the API Hub backend, developers must declare the following environment variables in their root .env.local:

• STREAM_SECRET: Encryption key string to sign client media playlists.
• REDIS_URL & REDIS_TOKEN: Optional Upstash credentials to replicate cache variables.