How to Authenticate a GB App

So you want to write an app that lets a user view premium videos, how should you do that? Just follow these simple steps!

Authentication

Method #1

1. Instruct the user to go to this url (replace 'appname' with the name of your app): http://www.giantbomb.com/app/myapp/
2. The user will see a code, tell them to put that CODE into your app
3. With the code the user entered, make GET request to: http://www.giantbomb.com/app/myapp/get-result?regCode=CODE&format=json
4. That API will return a 'regToken' use that regToken for premium API requests eg:
   1. http://www.giantbomb.com/api/videos/?api_key=regCode&format=json
   2. http://v.giantbomb.com/2017/02/11/mc_upf_021017_4000.mp4?api_key=regCode

Method #2

Some Apps require an alternate authentication flow:

1. Make a GET request to this URL (replace 'appname' with the name of your app): http://www.giantbomb.com/app/myapp/get-code?deviceID=appname
2. Display the regCode returned from that API call to the user
3. Tell the user to go to this URL and enter the code (replace 'appname' with the name of your app): http://www.giantbomb.com/app/myapp/activate
4. After the user authorizes your app, make a GET request to this API (using the regCode from the initial API call): http://www.giantbomb.com/app/myapp/get-result?regCode=regCode&deviceID=appname
5. That API will return a 'regToken' use that regToken for premium API requests eg:
   1. http://www.giantbomb.com/api/videos/?api_key=regToken&format=json
   2. {{video CDN url}}.mp4?api_key=regToken

Making API Requests

Save the regToken obtained from the Auth flow above on the user's device and use that token for all future API calls. This makes sure all API requests are tied to the user of your app.

Get a list of all videos: http://www.giantbomb.com/api/videos/?api_key=regToken&format=json

Play a video in that list: {{video CDN url}}?api_key=regToken

For full documentation of the API, check this out: http://www.giantbomb.com/api/documentation

Video Downloading

Video downloading within third party apps is allowed on the condition that you use the above video authentication method using the user's regToken. For example: {{video CDN url}}?api_key=regToken

This will allow us to track downloads by individual user accounts and prevent abuse.

Questions?

If you have any questions feel free to PM me (@wcarle) or contact support at giantbomb.com

This is great! Having such explicit instructions available will really help new app developers! (This should get stickied)

Quick question (I'd PM you but others might find the answer helpful): What is the timeline (if any) for deprecation of the old http://www.giantbomb.com/api/validate?link_code=[LINK_CODE] endpoint?

I also noticed that if you go to http://www.giantbomb.com/app/[APP_NAME]/ while not logged in you get prompted to log in (good) but after logging in you get taken to the Giant Bomb landing page instead of the app registration code page you initially requested.

Any chance this could get changed so users stay on the reg code page after logging in?

(This issue also exists on the old boxee link code page and I've had at least one user get completely lost after getting kicked over to the landing page and then give up because they were unable to find anything that looked like a link code)

@wcarle

I also noticed that if you go to http://www.giantbomb.com/app/[APP_NAME]/ while not logged in you get prompted to log in (good) but after logging in you get taken to the Giant Bomb landing page instead of the app registration code page you initially requested.

A redirect back to the app registration code page after this would be great -- about to build a sign in flow for my app, but users getting dumped to home page after signing in is rough :\

Thanks

@ara313: Reported this specific issue in the bug report forum:

http://www.giantbomb.com/forums/bug-reporting-33/accessing-api-token-pages-while-logged-out-dont-re-1807527/

@alecgdouglas: @ara313: Hey guys, that's a bug. I've created a fix for it which should go into a build this week

@wcarle: Awesome! Thanks very much

@ara313: @alecgdouglas: Hey guys, the fix is out. The redirect should work now!

Link leads to a 404, however, if you add a "/" it works.

I'm having trouble accessing the app registration endpoint from my js app

http://www.giantbomb.com/app/myapp/get-result?regCode=CODE&format=json

Does it support jsonp?