Sources and API keys
Which sources a server offers, which keys they need and their quotas.
The server holds the API keys, so the apps never see them. Sources without a key
are switched off; GET /v1/health lists the active ones.
| Source | Needs | Key name |
|---|---|---|
| Audius, Internet Archive, Deezer, LRCLIB | nothing | – |
| YouTube search and audio | yt-dlp/r-dlp (native) or the companion (Cloudflare) | YTDLP_PATH (native); YTDLP_SERVICE_URL, YTDLP_SERVICE_TOKEN (Worker) |
| YouTube playlist import | API key | YOUTUBE_API_KEY |
| Jamendo | client id | JAMENDO_CLIENT_ID |
| SoundCloud | client credentials (search, and SoundCloud links for Transfer music) | SOUNDCLOUD_CLIENT_ID, SOUNDCLOUD_CLIENT_SECRET |
| Spotify (metadata only) | client credentials | SPOTIFY_CLIENT_ID, SPOTIFY_CLIENT_SECRET |
| Last.fm | API key | LASTFM_API_KEY |
Set keys
Native
glyph config set lastfm_api_key # asks without echo
Or as environment variables, which win over server.toml.
Cloudflare
glyph cloudflare secret LASTFM_API_KEY
Remote
glyph remote keys set lastfm # youtube, jamendo, soundcloud, spotify, lastfm
Keys are never returned in responses or error messages. A source that fails or runs out of quota is skipped for 10 minutes.
Quotas
- YouTube search uses yt-dlp or r-dlp: no key, no quota. Only ids, titles, channels, durations and thumbnails are read.
- YouTube Data API (playlist import only): 10,000 units a day. The server
stops at
YOUTUBE_DAILY_BUDGET_UNITS(default 9000), reset at midnight UTC. - Spotify may restrict apps in development mode. Check Spotify's developer policy before opening the import to others.
How a song is resolved
The server looks a song up by ISRC first, then by title, artist and duration
(±3 s). Full-song sources are tried in order, by default Audius, Jamendo,
SoundCloud, YouTube; a Deezer preview is the last resort. With proxy_audio
(on by default, always on Cloudflare) audio streams through the server with
byte ranges, so the app can seek and never sees short-lived provider URLs.