The XAPlayer secure player with Node.js and Express

# .env (or your host's environment settings)
XAPLAYER_API_KEY=xap_sk_...

// xaplayer.js (Node 18 or later: fetch is built in)
const XAPLAYER = 'https://en.xaplayer.ir/api/v1';

export async function playerUrl({ courseId, videoId, user }) {
  const res = await fetch(`${XAPLAYER}/embed-tokens`, {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.XAPLAYER_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      ...(videoId ? { videoId } : { courseId }),
      viewer: { id: String(user.id), name: user.name },
    }),
  });
  if (!res.ok) throw new Error(`XAPlayer ${res.status}: ${await res.text()}`);
  const { url } = await res.json();
  return url;
}

// server.js
import express from 'express';
import { playerUrl } from './xaplayer.js';

const app = express();

// requireLogin and userBoughtCourse are your own: your sign-in and your orders.
app.get('/courses/:courseId/watch', requireLogin, async (req, res, next) => {
  try {
    if (!(await userBoughtCourse(req.user, req.params.courseId))) return res.sendStatus(403);
    const url = await playerUrl({ courseId: req.params.courseId, user: req.user });
    res.render('watch', { url }); // or any template engine you use
  } catch (err) {
    next(err);
  }
});