REST API

Meww.me exposes two API layers on the same Fastify server (default port 2555).

Architecture

 Frontend (React)           Fastify (port 2555)                   Bot Core
┌──────────────┐   HTTP    ┌─────────────────────────┐
│              │ ────────► │ /api/*  (Dashboard Proxy)│
│ Dashboard    │ � - �──────── │   Session auth (cookie)  │
│              │           │                          │
│              │   WS      │ Socket.IO server         │
│              │ � - �──────── │   Real-time events       │
└──────────────┘           └────────────┬─────────────┘
                                        │ internal HTTP
                           ┌────────────▼─────────────┐
                           │ /v1/*  (Internal API)     │
                           │   Token auth (header)     │
                           └──────────────────────────┘

Internal API (/v1/*)

The internal API is used by the DashboardPlugin proxy and can also be called directly by external services. It requires an Authorization header matching config.features.RestAPI.auth.

Authentication

Authorization: your_secret_api_token

The token is set in config.yml under features.RestAPI.auth.

IP/Domain Whitelist

If features.RestAPI.whitelist is non-empty, only requests from listed domains or IPs are accepted. The whitelist checks the Host header and x-forwarded-for.

Player Endpoints

Search

User Endpoints

Guild Endpoints

Global Endpoints

Dashboard Proxy API (/api/*)

The dashboard proxy layer is registered via DashboardPlugin. It wraps the internal API with session-based authentication (Discord OAuth2 cookie) and adds dashboard-specific endpoints.

Authentication

Session-based via mewwme-dash.sid cookie. The cookie is set after successful Discord OAuth2 login.

Auth Endpoints

Guild Management

Player Control

Search

User Data

AI Chat

Liked Songs

Premium

Admin Endpoints

These endpoints require the user to be a bot admin (ADMIN array or OWNER_ID).

Helpdesk/Ticket Admin

Webhook Server (Express - port 2444)

The Express WebServer handles external service webhooks on a separate port.

Top.gg Vote Webhook

Receives vote notifications. The Authorization header must match features.WebServer.TOPGG_VOTELOGS.TopGgWebhookSecret. Logs votes to the configured LogVoteChannelID.

Ko-fi Webhook

Receives payment and subscription events. The request body verification_token must match KoFi.VerificationToken in config. Processes:

• One-time donations
• Subscription creation
• Subscription renewal
• Subscription cancellation

Last.fm Callback

Handles the OAuth callback from Last.fm after a user authorizes the bot to scrobble on their behalf.

Response Format: Premium Status

GET /api/user/premium or GET /v1/user/:userId/premium

{
  "isPremium": false,
  "isOwner": false,
  "isAdmin": false,
  "hasAccess": false,
  "voteUrl": "https://top.gg/bot/928966154817523723/vote",
  "access": {
    "filters": true,
    "twentyFourSeven": true,
    "autoplay": true,
    "lastfm": true,
    "spotify": true,
    "songRequest": true,
    "language": true,
    "statusVoiceChannel": true,
    "prefix": true,
    "djRole": true,
    "controlButton": true,
    "playlist": true
  },
  "requirements": {
    "filters": "Voter",
    "twentyFourSeven": "Voter",
    "autoplay": "Voter",
    "lastfm": "Voter",
    "spotify": "Voter",
    "songRequest": "Voter",
    "language": "Voter",
    "statusVoiceChannel": "Voter",
    "prefix": "Voter",
    "djRole": "Voter",
    "controlButton": "Voter",
    "playlist": "Voter"
  }
}

The access object contains booleans for each gated feature. The requirements object contains the configured access level for each feature. The frontend uses these to render access overlays.