Wyzie Subs

Browser-safe Keys#

A browser-safe key is for code that runs in a visitor's browser. It can search and download subtitles and nothing else, and it only works from the sites you list. It is still visible to anyone who opens DevTools, so never put your normal key in a page.

A browser-safe key (wyzie-pub- followed by 32 letters and digits) is a child of your Pro key. It has no balance of its own: every request is billed to your Pro key, and the child stops at its own daily cap.

Create one#

Create and revoke them in the dashboard on a Pro account. Give each key a label, up to 20 domains, a daily cap (1 to 1,000,000 requests) and, if you like, an hourly cap per visitor address (default 120, up to 10,000). You can have 20 active browser keys.

Use it#

Use it like any key, from the page that is allowed to:

const res = await fetch("https://sub.wyzie.io/search?id=tt3659388&language=en&key=wyzie-pub-YOUR_KEY");

Which sites#

A request must come from a listed site. We check the Origin header, or the host of Referer when there is no Origin. example.com matches only that exact host. *.example.com matches its subdomains but not example.com itself, so list both to allow both. Wildcards on free hosting domains such as github.io or pages.dev are refused; list the exact host instead. Requests with no Origin and no Referer are refused unless you switch on the no-origin option for that key.

Which routes#

A browser key works on /search, /c/ downloads, /quote and /sources. Everything else answers 403: Transcribe, Fix Subtitles, bulk jobs, Wyzie Synced, AI translation, /download and every account or refund route.

Spoofed headers#

Origin and Referer headers can be faked by anything that is not a browser, so the domain list stops casual reuse but not a determined person. The real protection is the rest: the daily cap and the hourly cap per address limit the damage, the key cannot reach the expensive features, and you can revoke it at once in the dashboard.

Errors#

The site is not on the key's list, or the key is used on a route it may not reach.
The key's daily cap is used up. It resets at UTC midnight.
This address made too many requests with this key this hour. Retry-After says when to try again.

Billing#

Requests cost what they cost on your Pro key, so a browser key can use at most its daily cap in requests per day, and never more than your balance.

Privacy#

We store the key's label, its allowed domains and its caps, and count its use. Requests are checked against that, not against who the visitor is.

Webhooks

Fix Subtitles

Donations