For developers
Add a reel studio to any website or app
Embed Brandreel in your product with one server-side call: your users create, revise, share and publish on-brand reels without leaving your app or making an account.
- 01
Register
Get an app ID and a secret for your server.
- 02
Ask for a link
One POST after your login check returns a short-lived embed URL.
- 03
Frame it
Drop the URL in an iframe. Your users are making reels.
In short
Register your app to get an app ID and secret. On your server, after your own login check, POST to https://getbrandreel.com/api/apps/token with the secret and your user’s id; put the returned embedUrl in an iframe. Works with any backend — Node, Rails, PHP, Python or a serverless function. The secret never reaches the browser, each user sees only their own reels, and AI spend is recorded per user.
What your users get
- Create from one sentence — script, scenes, AI voiceover, AI music and up to three AI hero clips.
- Revise in plain words — every change request becomes a new version.
- Download, share, publish — MP4 up to 4K with SRT captions, a phone share page for Instagram Reels and TikTok, and YouTube Shorts publishing.
- Budgets — each reel has a spending cap covering AI steps and the render.
1. Register your app
Register at getbrandreel.com/register with your app’s name, ID (e.g. ownsites), website and a contact. The app secret is shown once: store it in your server environment as BRANDREEL_APP_SECRET, never in browser code, a mobile app or git. New apps are reviewed — build meanwhile; tokens work the moment you’re approved.
2. Ask for an embed link on your server
curl -X POST https://getbrandreel.com/api/apps/token \
-H "Authorization: Bearer $BRANDREEL_APP_SECRET" \
-H "Content-Type: application/json" \
-d '{"app":"ownsites","user":"biz_42"}'
# → { "token": "…", "embedUrl": "https://getbrandreel.com/embed/ownsites?token=…", "expiresAt": "…" }| Field | Required | Meaning |
|---|---|---|
app | yes | Your app ID |
user | recommended | Your own id for the reel owner — a business id shares reels across a team, a person id keeps them private. A–Z a–z 0–9 _ -, ≤64 chars, never an email. |
ttlSec | no | Link lifetime, 60–3600 seconds (default 300). It only has to last until the frame loads; it’s then swapped for a 12-hour session. |
export async function brandreelEmbedUrl(userId) {
const res = await fetch("https://getbrandreel.com/api/apps/token", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.BRANDREEL_APP_SECRET}`,
"Content-Type": "application/json",
},
body: JSON.stringify({ app: process.env.BRANDREEL_APP_ID, user: userId }),
});
if (!res.ok) throw new Error(`Brandreel ${res.status}: ${await res.text()}`);
return (await res.json()).embedUrl;
}import os, requests
def brandreel_embed_url(user_id: str) -> str:
r = requests.post(
"https://getbrandreel.com/api/apps/token",
headers={"Authorization": f"Bearer {os.environ['BRANDREEL_APP_SECRET']}"},
json={"app": os.environ["BRANDREEL_APP_ID"], "user": user_id},
timeout=10,
)
r.raise_for_status()
return r.json()["embedUrl"]3. Frame it
<iframe src="{{ embedUrl }}" title="Brandreel studio"
style="width:100%;height:90vh;border:0"
allow="clipboard-write"></iframe>Generate the link per page view, after your login check — never cache it or put it in a public page.
Errors
| Status | Meaning | What to do |
|---|---|---|
| 400 | Invalid body (bad user id, ttlSec out of range) | Fix the request |
| 401 | Unknown app or wrong secret | Check BRANDREEL_APP_ID / BRANDREEL_APP_SECRET |
| 403 | App pending approval or suspended | Wait for approval, or contact us |
| 429 | Too many failed attempts | Back off and retry later |
Show your customers their bill
Your server can read what any of your users spent, with the same secret. Amounts are what you are billed; format=csv returns every request and post as a spreadsheet. A pending or suspended app can still read its bill.
curl "https://getbrandreel.com/api/apps/usage?app=ownsites&users=site_1,site_2&from=2026-10-01&to=2026-10-31" \
-H "Authorization: Bearer $BRANDREEL_APP_SECRET"| Param | Required | Meaning |
|---|---|---|
users | yes | 1–200 of your own user ids, comma-separated; only those users’ requests and posts come back |
from / to | no | YYYY-MM-DD, inclusive |
format | no | csv for a spreadsheet instead of JSON |
Optional: sign tokens locally
Skip the network call by signing the same token yourself: HMAC-SHA256 over <app>.<user>.<exp> with the base64url-decoded secret as the key, base64url output without padding. exp is Unix seconds, at most 24 hours ahead. Then frame https://getbrandreel.com/embed/<app>?token=<token>.
import crypto from "node:crypto";
function brandreelToken(app, secret, userId, ttlSec = 300) {
const exp = Math.floor(Date.now() / 1000) + ttlSec;
const body = `${app}.${userId}.${exp}`;
const mac = crypto
.createHmac("sha256", Buffer.from(secret, "base64url"))
.update(body)
.digest("base64url");
return `${body}.${mac}`;
}Security model
| Who | Holds | Can do |
|---|---|---|
| Your server | App secret | Open the studio as any of your users |
| Your user’s browser | One studio session for them | Make, change, share and publish only their own reels, for up to 12 hours |
| Anyone else | Nothing | Nothing |
A lost or leaked secret can be replaced; the old one stops working immediately. Step-by-step walkthrough: how to embed an AI reel maker in your website.
Questions
- What do I need to integrate Brandreel?
- A registered app (ID + secret), a backend that can make one HTTPS POST, and a page on your registered website to hold the iframe.
- Do my users need Brandreel accounts?
- No. They stay signed in with your app; your server vouches for them with a short-lived token that opens the studio as that user only.
- Can the studio be framed on any site?
- No — only on the origins registered for your app. Brandreel sends a frame-ancestors policy listing exactly those origins.
- How is AI spend controlled?
- Every reel has a budget that its creator sets within your app’s limits; AI steps and renders stop at that budget. Spend is recorded per app and per user id.