Scope and limitations
Owned by this Music API repository
- Exact-origin allowlist and credentialed CORS headers.
- OAuth code exchange orchestration between Camel Accounts and Ngamia.
- HttpOnly access/refresh cookie settings and refresh-on-401 helper.
- Input validation for the dedicated model and generation endpoints.
- Audio response streaming and selected response-header forwarding.
- Express
/api/ngamia/v1/*middleware forwarding, public music GET exception, and request header allowlist. - Health response
{service:"ngamia-music-api",status:"ok"}.
Owned elsewhere
| Behavior | Owner |
|---|---|
| User identity, consent screen, OAuth authorization and token validity | Camel Accounts |
| Ngamia account tokens, account profile, model catalog, credit balance | Ngamia API |
| Music generation engine, cost calculation, activity records and persisted creations | Ngamia API |
| Creation visibility persistence and public link availability | Ngamia API |
| Mobile-money providers, validation, confirmation and settlement | Ngamia API/payment provider |
PKCE verifier generation, OAuth state comparison, UI login redirects | Music web app |
| Track playback UI, library browsing, progress indicators and displayed estimates | Music web app |
Not guaranteed by this API
The proxy does not validate upstream resource schemas or enforce application roles. It is mounted at /api/ngamia/v1 and checks that the reconstructed target begins with /v1/. It forwards methods reaching that Express middleware, while browser CORS advertises only GET, POST, PATCH, DELETE, and OPTIONS. It does not add rate limiting or request IDs. Generation idempotency depends on upstream support; forwarding a key alone does not guarantee deduplication. A successful payment prompt initiation does not mean settlement. A generation timeout does not prove that no track was created.
Keep the docs current
When a route changes, compare the relevant controller under api/src/modules/, bootstrap and proxy middleware in api/src/main.ts, and helpers under api/src/shared/. For proxied operations, also inspect the Ngamia API contract because the Music repository cannot establish the upstream request schema, authorization policy, or side effects.