Build on your station.

{
  "error": {
    "code": "not_found",
    "message": "Station not found"
  }
}

Authorization: Bearer nbx_live_YOUR_KEY
# or
X-API-Key: nbx_live_YOUR_KEY

curl https://streaming-api.nobexpartners.com/v1/stations \
  -H "Authorization: Bearer nbx_live_YOUR_KEY"

curl https://streaming-api.nobexpartners.com/v1/stations/moonlightfm/now-playing \
  -H "X-API-Key: nbx_live_YOUR_KEY"

curl -X POST https://streaming-api.nobexpartners.com/v1/stations/moonlightfm/start \
  -H "Authorization: Bearer nbx_live_YOUR_KEY"

const API = "https://streaming-api.nobexpartners.com";
const KEY = process.env.NOBEX_API_KEY; // nbx_live_...

async function nobex(path, init = {}) {
  const res = await fetch(API + path, {
    ...init,
    headers: {
      Authorization: "Bearer " + KEY,
      "Content-Type": "application/json",
      ...(init.headers || {}),
    },
  });
  const body = await res.json();
  if (!res.ok) throw new Error(body.error.code + ": " + body.error.message);
  return body;
}

const { data: stations } = await nobex("/v1/stations");
for (const s of stations) {
  const np = await nobex("/v1/stations/" + s.id + "/now-playing");
  console.log(s.name, "-", np.now_playing ? np.now_playing.title : "off air");
}

import os, requests

API = "https://streaming-api.nobexpartners.com"
session = requests.Session()
session.headers["Authorization"] = "Bearer " + os.environ["NOBEX_API_KEY"]

stations = session.get(f"{API}/v1/stations").json()["data"]
for s in stations:
    r = session.get(f"{API}/v1/stations/{s['id']}/history", params={"limit": 5})
    r.raise_for_status()
    for play in r.json()["data"]:
        print(s["name"], play["played_at"], play["artist"], "-", play["title"])

{
  "id": "4f1c1a2e-6f0e-4d0b-9c2a-8b5f3d2e1a77",
  "type": "track.started",
  "created_at": "2026-09-08T14:03:11.204Z",
  "api_version": "2026-09-08",
  "data": {
    "station": { "id": "moonlightfm", "slug": "moonlightfm", "name": "Moonlight FM" },
    "track": {
      "title": "Backseat Star",
      "artist": "The Hold Steady",
      "album": null,
      "isrc": null,
      "source": "autodj",
      "started_at": "2026-09-08T14:03:10.980Z"
    },
    "listeners": 42
  }
}

{
  "id": "0d9b7c44-2a1e-4c6b-b1f3-5e2a9c8d7f10",
  "type": "station.online",
  "created_at": "2026-09-08T06:00:02.118Z",
  "api_version": "2026-09-08",
  "data": {
    "station": { "id": "moonlightfm", "slug": "moonlightfm", "name": "Moonlight FM" },
    "at": "2026-09-08T06:00:02.118Z"
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

// rawBody must be the exact bytes received — verify BEFORE JSON.parse.
export function verifyNobexSignature(secret, header, rawBody, toleranceSeconds = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!t || !parts.v1) return false;
  if (Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false;

  const expected = createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(parts.v1, "hex");
  return a.length === b.length && timingSafeEqual(a, b);
}

// Express: keep the raw body available.
// app.post("/hooks/nobex", express.raw({ type: "application/json" }), (req, res) => {
//   if (!verifyNobexSignature(process.env.NOBEX_WEBHOOK_SECRET, req.get("X-Nobex-Signature"), req.body.toString())) {
//     return res.status(400).end();
//   }
//   const event = JSON.parse(req.body.toString());
//   res.status(204).end(); // reply fast, then do the work
// });

import hmac, hashlib, time

def verify_nobex_signature(secret: str, header: str, raw_body: bytes, tolerance=300) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    t, v1 = parts.get("t"), parts.get("v1")
    if not t or not v1:
        return False
    if abs(time.time() - int(t)) > tolerance:
        return False
    signed = f"{t}.".encode() + raw_body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

# Flask
# @app.post("/hooks/nobex")
# def hook():
#     if not verify_nobex_signature(SECRET, request.headers["X-Nobex-Signature"], request.get_data()):
#         abort(400)
#     event = request.get_json()
#     return "", 204

GET https://streaming-api.nobexpartners.com/public/stations/{slug}/events

const es = new EventSource(
  "https://streaming-api.nobexpartners.com/public/stations/moonlightfm/events"
);

es.addEventListener("now_playing", (e) => {
  const np = JSON.parse(e.data);
  document.getElementById("track").textContent = np.now_playing
    ? np.now_playing.artist + " — " + np.now_playing.title
    : "Off air";
});

es.addEventListener("listeners", (e) => {
  document.getElementById("count").textContent = JSON.parse(e.data).listeners;
});

es.addEventListener("station.offline", () => {
  document.getElementById("track").textContent = "Off air";
});

// EventSource reconnects on its own after a drop and you get a fresh
// now_playing on every connect, so there is no state to rebuild.