Skip to main content
The Rocksky API is an XRPC (AT Protocol) API. Every endpoint lives under the app.rocksky.* namespace and is reachable at https://api.rocksky.app/xrpc/<nsid>.

​
Base URL

​
Authentication

Authenticated endpoints expect a bearer token in the Authorization header:
You can obtain a token by: Public profiles, charts, public scrobble feeds, and search work without authentication. Private library, notification, and account operations require authentication even when they only read data. Some public endpoints accept a token to include viewer-specific information. Each endpoint lists its own authentication requirements.

​
Personal access tokens

Access tokens are long-lived JWTs you generate from the web UI for scripts, CLIs, and integrations that can’t run an interactive OAuth flow. They behave exactly like an OAuth-issued JWT — pass them in the Authorization: Bearer header on any authenticated endpoint. Create / list / revoke them at: The full secret is shown once, at creation — copy it somewhere safe. Subsequent listings only show the last four characters. Deleting a token revokes it immediately on the API side (no waiting for expiry).

​
Audioscrobbler endpoints

For Last.fm / ListenBrainz compatibility, Rocksky exposes a separate host:

​
SDKs

Prefer typed bindings? Use one of the official SDKs in TypeScript, Python, Rust, Go, Ruby, Kotlin, Elixir, Clojure, or Gleam — every endpoint in this reference is wrapped.

​
Errors

Non-2xx responses return an XRPC-style error body:
The HTTP status code carries the category (400-class for client errors, 500-class for server errors).

​
OpenAPI spec

The endpoint reference below is generated directly from the OpenAPI specification shipped with this site. It follows the registered XRPC routes and lexicons in the Rocksky source repository. Production may run an earlier revision. Queries use GET; procedures use POST. Some procedures take query parameters instead of a JSON body, so follow the parameter location shown on each endpoint. Nullable response fields are distinct from optional fields. OpenSubsonic payloads retain provider-defined fields. Routes whose handlers are unfinished are marked in the reference. Some handlers return empty fallback objects when an upstream service fails; HTTP 200 alone does not always mean that a lookup found data.