SDKs & Client Libraries

Broadcast has a REST API, and you can call it with curl. The official client libraries exist because a handful of details are easy to get wrong by hand — retries that respect Retry-After, warnings on successful responses, credential fields that come back masked — and getting them wrong is quiet rather than loud.

Every library covers all 104 API operations. None of them is a subset.

Available Libraries

What They All Do the Same Way

The libraries are not independent re-implementations. They share one behavioural contract, so an integration you understand in Ruby reads the same in PHP.

host is always required. Broadcast is self-hosted first, so every instance has its own domain. No client guesses one. All of them read BROADCAST_HOST and BROADCAST_API_TOKEN from the environment — the same variables the Agents CLI stores in ~/.config/broadcast/config.

Warnings are surfaced, not swallowed. A successful write can still report that it ignored part of your request — a misspelled attribute, a filter it could not parse. Every client exposes these on the response, and can be configured to raise on them instead. See API Response Warnings.

Retries are bounded and selective. Timeouts, 429s, and 5xx are retried with backoff, honouring Retry-After up to a configurable ceiling. A 422 is never retried — it is deterministic, so retrying only adds latency.

Credentials are protected from round-tripping. The API returns credential fields bullet-masked (••••••••). Reading an email server and writing it back unchanged would replace a working SMTP password with those bullets. Every client strips masked values out of update payloads and warns instead. This is a data-loss guard, not a convenience.

Redirects are never followed blindly. Every request carries your API token. A redirect to another host would hand that token over, so no client follows one — and none follow redirects on writes at all. A redirect almost always means host is misconfigured, and the error says so.

Webhook verification is identical. HMAC-SHA256 over timestamp.payload, a five-minute tolerance, constant-time comparison. All four produce byte-identical signatures for the same input.

Choosing an Approach

Getting an API Token

All the libraries authenticate the same way:

1. Log in to your Broadcast dashboard
2. Go to Settings → API Keys
3. Click New API Key
4. Name it and select only the permissions your integration needs
5. Copy the token — it is shown once

Permissions are fixed when the key is created, so a key that turns out to need more access has to be reissued. API Authentication lists every permission and what it covers.

Reporting Issues

Each library is open source and tracks issues in its own repository:

• broadcast-ruby
• broadcast-php
• broadcast-node
• broadcast-python

If the API itself is behaving unexpectedly rather than a client, the API Authentication section is the better starting point.