Emby API auth issue in custom Stremio addon

[Hars084 3]

Hi everyone,

 

I’m working on a Stremio addon (StreamBridge) that connects to Emby and authenticates using /Users/AuthenticateByName. It works for most users, but a few get 401 errors even with correct credentials.

 

The addon has a config page where users enter server URL, username, and password, and it calls the API to fetch the user ID and access token. It works fine for some, but fails for others. Some are not even able to get access token and for some it keeps on expiring.

 

Here’s the JS snippet I use to het userID and access token for further requests to server:

const res = await fetch(`${url}/Users/AuthenticateByName`, {

  method: "POST",

  headers: {

    "Content-Type": "application/json",

    "X-Emby-Authorization": 'MediaBrowser Client="StreamBridge", Device="WebHelper", DeviceId="webhelper", Version="1.0.0"'

  },

  body: JSON.stringify({ Username: user, Pw: pass })

});

const data = await res.json();

if (!res.ok) throw Error(data.Message || "Auth failed");

Anyone seen this before? Could it be something with Emby config, server version, or security settings?

 

Here’s the repo if you want to take a look: https://github.com/h4harsimran/streambridge

 

Thanks!

[Luke 42077]

Hi, that looks like. Have you personally reproduced the problem, or are you just taking their word for it that they've entered the correct credentials?

[Hars084 3]

I have not been able to reproduce myself. Its working fine for me but I am just getting that feedback from people over internet. My first thought was also that they are not writing right username, password or server URL. But some were able to get useID and access token but nothing was showing in their stream. I checked logs of my addon server and it mentioned token expired.

Edited May 31, 2025 by Hars084

[Luke 42077]

35 minutes ago, Hars084 said:

I have not been able to reproduce myself. Its working fine for me but I am just getting that feedback from people over internet. My first thought was also that they are not writing right username, password or server URL. But some were able to get useID and access token but nothing was showing in their stream. I checked logs of my addon server and it mentioned token expired.

It could be any number of things besides just incorrect login.

For example, it looks like you're expecting local server credentials. Maybe they're confusing the difference with Emby Connect and entering Emby Connect credentials into your UI.

Or maybe they restricted device access and forgot about it, or remote access. The server log will usually have the answer.

[Ratatouille 14]

Where can I get this addon?

 

[Hars084 3]

You can use this link StreamBridge or link on my github repository mentioned in original post.

[Ratatouille 14]

Thank you, but  got error  NetworkError when attempting to fetch resource.
on another browser got Failed to fetch?

the curl cmd got me 

Value cannot be null. (Parameter 'name')-bash: -H: command not found
-bash: -H: command not found
-bash: -d: command not found

 

[Ratatouille 14]

Well I was able to make it work by using my proxy address https://emby.xxxxxxx.duckdns.org instead of http://http://192.168.50.50:8096

Edited June 11, 2025 by Ratatouille

[Hars084 3]

Glad it worked out. Looks like emby server need to behind https:// to get user access tokens. 

[beta666 3]

On 6/12/2025 at 12:45 AM, Hars084 said:

Glad it worked out. Looks like emby server need to behind https:// to get user access tokens. 

Hello,

why do you have to add a key?

My brother and I tried to connect — it worked.
But when I block the account on Emby, he can still keep watching. Why?

Isn't it possible to connect just using the URL with email and password?

[Luke 42077]

2 hours ago, beta666 said:

 

Hello,

why do you have to add a key?

My brother and I tried to connect — it worked.
But when I block the account on Emby, he can still keep watching. Why?

Isn't it possible to connect just using the URL with email and password?

Hi, is this a general Emby question or specific to stremio?

[beta666 3]

14 hours ago, Luke said:

Hi, is this a general Emby question or specific to stremio?

Emby 

[Hars084 3]

18 hours ago, beta666 said:

 

Hello,

why do you have to add a key?

My brother and I tried to connect — it worked.
But when I block the account on Emby, he can still keep watching. Why?

Isn't it possible to connect just using the URL with email and password?

Hey! The addon is designed to be stateless, meaning it doesn’t store anything on its own server.

 

That’s why we ask for your Emby username and password — so addon can fetch an access token and save it locally in your Stremio config. This token is required for any request to the Emby server.

 

We don’t store the token ourselves — it stays on your device, keeping things more private and secure.

 

As for your brother still having access after being blocked, it could be that his token is still valid. Its not explicitly stated in Emby documentation but I believe it is not revoked unless you revoke it in your server settings or the user specifically send a POST request to logout endpoint. I will let more experienced Emby devs then me to confirm.

Edited June 30, 2025 by Hars084

[beta666 3]

3 hours ago, Hars084 said:

Hey! The addon is designed to be stateless, meaning it doesn’t store anything on its own server.

 

That’s why we ask for your Emby username and password — so addon can fetch an access token and save it locally in your Stremio config. This token is required for any request to the Emby server.

 

We don’t store the token ourselves — it stays on your device, keeping things more private and secure.

 

As for your brother still having access after being blocked, it could be that his token is still valid. Its not explicitly stated in Emby documentation but I believe it is not revoked unless you revoke it in your server settings or the user specifically send a POST request to logout endpoint. I will let more experienced Emby devs then me to confirm.

Hi,
why does the message appear when I click on “Get Access Info”?

Edited June 30, 2025 by beta666

[Hars084 3]

22 hours ago, beta666 said:

Hi,
why does the message appear when I click on “Get Access Info”?

When I developed this, I did not think if it will work with unsecured servers. My server was behind a secured https address. Someone above in the thread was able to solve this by using a proxy address (https://) from duckdns.org

[Jekaboom 4]

On 5/31/2025 at 4:11 AM, Hars084 said:

Hi everyone,

 

I’m working on a Stremio addon (StreamBridge) that connects to Emby and authenticates using /Users/AuthenticateByName. It works for most users, but a few get 401 errors even with correct credentials.

 

The addon has a config page where users enter server URL, username, and password, and it calls the API to fetch the user ID and access token. It works fine for some, but fails for others. Some are not even able to get access token and for some it keeps on expiring.

 

Here’s the JS snippet I use to het userID and access token for further requests to server:

const res = await fetch(`${url}/Users/AuthenticateByName`, {

  method: "POST",

  headers: {

    "Content-Type": "application/json",

    "X-Emby-Authorization": 'MediaBrowser Client="StreamBridge", Device="WebHelper", DeviceId="webhelper", Version="1.0.0"'

  },

  body: JSON.stringify({ Username: user, Pw: pass })

});

const data = await res.json();

if (!res.ok) throw Error(data.Message || "Auth failed");

Anyone seen this before? Could it be something with Emby config, server version, or security settings?

 

Here’s the repo if you want to take a look: https://github.com/h4harsimran/streambridge

 

Thanks!

Hello - just stopping by to let you know this was the final piece of the puzzle for my dream setup. I can now have the benefits of Stremio but not loose access to my well curated local library I have built over the years; easly switching the different language / quality versions regardless if its sourced through my emby library or via stremio. This is awesome and I thank you for coding this addon  I believe if more people get aware of this it will be quite a thing.

[yiyet 0]

@Luke

Hi Luke,
I found a serious security vulnerability in this plugin — Emby is unable to detect streaming activity through it.

As mentioned, this plugin is designed without storing any status on the Emby server.

I tested it by streaming on 5 devices simultaneously, even though I had set the streaming limit to just 1 per account. And what happened? All devices were able to stream at the same time.

This is very dangerous if someone deliberately shares the plugin with many people — it could have a severe impact on the Emby server.

It seems that Emby's security needs to be strengthened, or this plugin should be redesigned so that streaming activity can be detected by Emby.

 

Edited October 18, 2025 by yiyet

[Luke 42077]

14 minutes ago, yiyet said:

@Luke

Hi Luke,
I found a serious security vulnerability in this plugin — Emby is unable to detect streaming activity through it.

As mentioned, this plugin is designed without storing any status on the Emby server.

I tested it by streaming on 5 devices simultaneously, even though I had set the streaming limit to just 1 per account. And what happened? All devices were able to stream at the same time.

This is very dangerous if someone deliberately shares the plugin with many people — it could have a severe impact on the Emby server.

It seems that Emby's security needs to be strengthened, or this plugin should be redesigned so that streaming activity can be detected by Emby.

 

 

Hi there, let's look at an example. Please attach the information requested in how to report a media playback issue. Thanks!

 

[Flippz 38]

Have not tested this alot yet, but seems to work great. U need to use a tool to push this addon to the top to get emby content added to the top of the result lists but thats fine. Would it be possibe @Hars084to be able to change the name emby, in the results list, to something else?

Edited November 2, 2025 by Flippz
typo

[Hars084 3]

14 minutes ago, Flippz said:

Have not tested this yes alot but seems to work great. U need to use a tool to push this addon to the top to get emby content added to the top of the result lists but thats fine. Would it be possibe @Hars084to be able to change the name emby, in the results list, to something else?

I would add it to my to do list. Pretty easy to implement just need to make sure it does not break current functionality. Also, planning to implement more info about streams based on some suggestions from reddit thread. 

[Hars084 3]

On 18/10/2025 at 17:31, yiyet said:

@Luke

Hi Luke,
I found a serious security vulnerability in this plugin — Emby is unable to detect streaming activity through it.

As mentioned, this plugin is designed without storing any status on the Emby server.

I tested it by streaming on 5 devices simultaneously, even though I had set the streaming limit to just 1 per account. And what happened? All devices were able to stream at the same time.

This is very dangerous if someone deliberately shares the plugin with many people — it could have a severe impact on the Emby server.

It seems that Emby's security needs to be strengthened, or this plugin should be redesigned so that streaming activity can be detected by Emby.

 

I thought a lot about it, it’s complicated to implement. So, addon the way its setup is don’t store any data, user id, password or API key on addon server. All of this is in the config URL that you receive to install the addon. Now, once you click on a item in stremio, stremio send the imdb id to addon, addon look for it in your library and provide the direct play URL. After that it vanishes, it does not know if you watched whole video, half of it or any of it. Emby has a separate API endpoint, where the client can tell the emby server that user started to watch this video, server add that to number of stream you are watching, client need to keep replying every 10-15sec that yes user is still watching the video, and reply again once user stop watching to remove that from number of steams playing. This whole setup would require data to be stored, which bring complications. And stremio is not built to send info after the original request is made through addon. So, if I set it up to register streams, it would lock people from watching on other devices even if when they stop on stremio. Hope it clears the confusion.
 

[Flippz 38]

Iv tested a bit more. I was going to watch a episode of something but turns out it was not found in stremio for emby. I checked emby and yes it was missing. Fixed it in emby and went back to stremio, but it does not show there. How often does it check emby for files?

[Hars084 3]

1 hour ago, Flippz said:

Iv tested a bit more. I was going to watch a episode of something but turns out it was not found in stremio for emby. I checked emby and yes it was missing. Fixed it in emby and went back to stremio, but it does not show there. How often does it check emby for files?

This is the kind of user feedback I need. Looks like I did not implement cache-control: max age. So stremio keeps looking at cached content. Ler me add it my To-do list to fix. For now, you can try to clear cache of the app and see if it works.

[Deal1990 1]

Hi I love your plugin, but there are 2 things I would love to see in the future if you could implement it somehow.

1. thing would be a catalog integration feature to see my recent added shows / movies 

2. the use of an external player, I use it on Apple TV and infuse is by far the best player

thanks for the great work 

[Hars084 3]

6 hours ago, Hars084 said:

This is the kind of user feedback I need. Looks like I did not implement cache-control: max age. So stremio keeps looking at cached content. Ler me add it my To-do list to fix. For now, you can try to clear cache of the app and see if it works.

Added cache logic. Stremio would cache the links for 2min if they any stream is found. It would not cache if there are no stream. Should solve the issue you were facing earlier.