Streaming

Parameters

This endpoint takes no parameters.

Request Body

{
  "origin": "https://app.example.com"
}

• originstring

  The web origin of the page that will open the stream: an https origin, or http on localhost, 127.0.0.1 or [::1], written exactly as a browser sends it in Origin (scheme and host, an optional non-default port, no path or trailing slash).

Request

curl -s -X POST "https://api.cantoncap.cc/v1/stream/tickets" \
  -H "X-API-Key: $CANTONCAP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"origin":"https://app.example.com"}'

Response

200 A ticket redeemable once, from the given origin, until expires_at.

{
  "status": {
    "timestamp": "2026-10-11T14:00:00.000Z",
    "elapsed_ms": 18,
    "error_code": 0,
    "error_message": null,
    "request_id": "req_7Hk2pQ9xLm"
  },
  "data": {
    "ticket": "cst_Xq8vN2cTf0LmZ7rKpA4sWb1hYe9uJd3gQo6iVxC5nRt",
    "origin": "https://app.example.com",
    "expires_at": "2026-10-11T14:00:30.000Z"
  }
}

• dataobject
  3 child fields

  • ticketstring

    Opaque single-use ticket. Treat it as a secret until it is redeemed.

  • originstring

    The origin the ticket is bound to.

  • expires_atdate-time

    When the ticket stops being redeemable, at most 30 seconds after issue.

Headers

• X-RateLimit-Limit Maximum requests admitted in the current plan window, which every key of an account shares.
• X-RateLimit-Remaining Requests remaining in the current plan window, across every key of the account.
• X-RateLimit-Reset Unix timestamp in seconds when the current plan window resets.
• Cache-Control private, no-store Prevents every cache, private or shared, from storing the response. Every error response carries it.

Errors