YouTube Integration & POT Tokens

Current OAuth 2.0 authentication architecture and planned Proof-of-Origin Token (POT) integration for YouTube streaming.

YouTube remains one of the largest audio repositories for user-generated content, remixes, and niche recordings. Due to YouTube's strict anti-bot mitigations and automated rate limiting, Musiva employs specialized authentication mechanisms within Lavalink.

Current Architecture: OAuth 2.0 & Refresh Tokens

Musiva currently utilizes the official dev.lavalink.youtube:youtube-plugin with OAuth 2.0 authentication and persistent Refresh Tokens.

Lavalink Startup
       ↓
Refreshes YouTube OAuth Bearer Token via Google API
       ↓
Simulates Certified TV / Embedded Web Clients
       ↓
Bypasses Sign-in and IP Rate Limits (HTTP 429)

Lavalink Configuration Example:

application.yml

plugins:
  youtube:
    enabled: true
    allowSearch: true
    allowDirectVideoIds: true
    allowDirectPlaylistIds: true
    clients:
      - TV
      - ANDROID_VR
      - MUSIC
      - ANDROID_MUSIC
      - TVHTML5_SIMPLY
      - WEBEMBEDDED
      - WEB
      - MWEB
    oauth:
      enabled: true
      refreshToken: "YOUR_YOUTUBE_REFRESH_TOKEN"
      skipInitialization: true
    remoteCipher:
      url: "https://cipher.kikkia.dev/"
      userAgent: "musiva-lavalink-bot"

Proof-of-Origin Token (POT Token)

Status: Planned (Not Currently Active)

Proof-of-Origin Token (POT) support is not yet enabled in Musiva production. It is scheduled for deployment once the upstream Lavalink YouTube plugin releases stable production support for POT token generation.

Planned Hybrid Strategy

When upstream support is finalized, Musiva will transition from pure OAuth to a three-tier hybrid authentication model:

┌───────────────────────────────────────────────┐
│           Hybrid Authentication Model         │
├───────────────────────────────────────────────┤
│  1. OAuth 2.0                                 │
│  2. Persistent Refresh Token                  │
│  3. Real-Time POT Token (Proof-of-Origin)     │
└───────────────────────────────────────────────┘

Objectives of the Hybrid Model:

Rate Limit Immunity: Mitigate automated 429 Too Many Requests responses when handling large server playback spikes.
Signature Verification: Satisfy YouTube's newest player script signature requirements.
Continuous Fallback: If one authentication tier experiences temporary throttling, the player automatically falls back to secondary verification headers.