Developers

A small read-only API so apps — starting with RN Editor — can search Asset and Libraries and import assets directly. Create a key under Admin → API keys.

Authentication

Every request needs your app key in the x-api-key header. Endpoints that touch a person's entitlements also need that person's Supabase access token as a bearer token, so the free-download quota and membership rules stay exactly the same inside the app as they are on the website.

x-api-key: rn_live_xxxxxxxxxxxxxxxxxxxx
Authorization: Bearer <supabase access token>

Endpoints

GET/api/v1/assets?q=leaf&kind=icon&paid=false&page=1&limit=30

Search the library. Returns metadata and a public preview URL for each asset.

GET/api/v1/assets/{id}

One asset's full metadata.

GET/api/v1/me

Whether this user is a member, and how many free downloads they have left.

POST/api/v1/download/{id}

Returns a signed file URL, valid for two minutes. Applies the same free-quota and membership rules as the website.

Example — search from Android (Kotlin)

val request = Request.Builder()
    .url("https://your-site.vercel.app/api/v1/assets?q=leaf&kind=icon")
    .addHeader("x-api-key", BuildConfig.RN_ASSETS_KEY)
    .addHeader("Authorization", "Bearer " + supabase.auth.currentAccessTokenOrNull())
    .build()

client.newCall(request).execute().use { response ->
    val body = response.body?.string() ?: return
    val items = JSONObject(body).getJSONArray("items")
    // items[i].preview_url  -> show in the picker
    // items[i].id           -> pass to /api/v1/download/{id}
}

Importing a file

POST /api/v1/download/{id}

200 {
  "url": "https://…/object/sign/assets/…?token=…",
  "expires_in": 120,
  "filename": "Minimal grey gradient.png",
  "remaining_free": 18
}

403 {
  "error": "This is a premium asset. Subscribe for ₹24/month to download it.",
  "reason": "need_subscription"
}

Download the file from url straight away — the link expires in two minutes and is single-purpose. When you get a 403, show the user the message and open the pricing page in a browser.

Rate limits and fair use

Keys are tied to the app, not the user, and can be revoked at any time from the admin panel. Cache preview URLs on the device rather than re-fetching them on every keystroke — previews are served straight from the storage CDN and do not count against anything.