Security Model

For the most part, your interaction with OPML will require nothing more in the way of security than your partner ID.

Some API methods need a RadioTime account name in order to retrieve content. These should be supplied in the standard username query string parameter. If you wish to transmit this information securely, you can make your calls over HTTP/S.

Authentication

To check the validity of credentials with the OPML service, you can use the Account method’s auth command.

Request Restrictions

By default, completely anonymous access to the API is limited to a few hundred calls per day. Beyond that threshold you will receive HTTP error codes from the service.

Anonymous Accounts

For applications and devices wishing to take advantage of account features without requiring an explicit RadioTime registration, we support an “anonymous” account option.

First you will need to contact development@radiotime.com to request this capability in your partner profile. Then, you must determine a means to assign a unique, non-guessable ID to every client of your product. The ID should persist for the lifetime of the client (rather than, say, generating a new ID every time the application starts up).

You will pass the unique ID to the API using the serial query string parameter. Again, for security, you may transmit this information over HTTP/S if you wish.

Users may later “claim” this anonymous account on RadioTime.com by completing a verification process. This typically involves calling the Register method to generate a key, and entering the key on the website. Alternatively, you can use the Account join command to associate your device directly with an existing account, or use the create command to create a new account.