[FEATURE] API Documentation / Authentication

[choeger]

Is your feature request related to a problem? Please describe. I have seen that the source code uses a fixed API key, and if google isn't wrong about it, the very same key is used in RaceControl. As I very much like this application, I am worried that the backend devs might cut us off. So I wonder if we could reach some kind of agreement with f1tv. If I was to fork or reimplement f1viewer (e.g., trying to run It directly on my tv), I currently would need to copy the API key. If my app did something stupid, the backend devs could revoke the key and thus harm f1viewer and racecontrol both.

Describe the solution you'd like I'd like to have a clearly documented API and a clearly documented way to obtain an API key for an authenticated user. I would appreciate any kind of documentation for the f1tv APIs that you could come up with.

Describe alternatives you've considered We (as a community) might simply get by with an informal contact to f1tv to obtain a couple of new API keys and distribute them.

Additional context Generally speaking, I think the idea of independent clients is great and f1tv should be glad to have them. But I am worried that we might end up getting closed down because some MBA doesn't understand it and sees it as a copyright infringement. I am also worried that f1tv could roll out some DRM foo. So maybe we should have some kind of low-visibility forum to discuss such matters.

[LsHallo]

AFAIK the api key is not specific to f1viewer and racecontrol. It is used by the javascript on the website and embedded in the requests made if you normally browse the f1 website. I think it's some kind of key for their streaming backend. The iOS and Android app probably also use it to connect to the website. I don't think it's possible to get a specialized key. (It might even be the case that the front end devs could not get another key if the wanted depending on what streaming partner they are using)

It is also probable that they might incorporate some sort of protection in the near future. Not specifically to lock us out, but to make downloading and illegal sharing harder. Then it will either be the end for all 3rd party programs or an arms race will ensue like with NF and AMZN (Although f1tv might lack popularity to develop such tools).

[hash55]

And the old api is still available or it is not distributed by FOM anymore? I have some issues with the new one, so I tried to use an old version of F1Viewer. Everything works fine until Portugal where the new API was released. So I would be very pleased if you could tell me how to use the other API for this races (If possible)

[LsHallo]

If you've had no luck with the old api it is probably not going to work. The app also uses the new api now so there is little reason to keep the old one going. I would not recommend developing software right now with the old api. It's not going to last long. I am checking https://f1tv.formula1.com/2.0/R/ENG/WEB_HLS/ALL/PAGE/395/F1_TV_Pro_Annual/2 to see if there is a live event. It will be a big json with a resultObj. In the resultObj will be containers of events with their respective ids. (Denoted by the contentId field) When you then want to get the url for the m3u8 playlist you make a request to https://f1tv.formula1.com/1.0/R/ENG/WEB_HLS/ALL/CONTENT/PLAY?contentId={contentId} and in the resultObj again will be url. That is the m3u8 playlist to pipe into ffmpeg etc.

To login in the first place you make a post request to https://api.formula1.com/v2/account/subscriber/authenticate/by-password. The payload should be json: {"Login": "E-MailHere", "Password": "PasswordHere"} The header needs to have the apikey field set with fCUCjWrKPu9ylJwRAv8BpGLEgiAuThx7 being the api key. The response should be json and contains sessionId and subscriptionToken. Use those set in the header to make a request to https://f1tv.formula1.com/1.0/R/ENG/WEB_DASH/ALL/USER/ENTITLEMENT to aquire an entitlement token. The entitlement token is needed for all requests made to the content urls listed above. To my knowledge it is valid for 7 days.

The best way to learn the api is to navigate on f1tv and have the chrome dev tools open so check all requests made. It will require some digging but you will be able to find almost anything since f1tv itself uses the api exclusively to display all content. Just click on some older races and observe the requests made.

I am not using any part of the api to get historical races etc so i can' tell you any more.

Further sources: https://github.com/robvdpol/RaceControl https://github.com/kodosexe/F1Hub