Add the AddonPass check to your addon.

pnpm add @addon-pass/sdk

ADDONPASS_API_URL=https://api.addonpass.com
ADDONPASS_INTEGRATION_CREDENTIAL=ADDON_SCOPED_CREDENTIAL
# Leave empty until you create a plan, then list its ID and redeploy.
ADDONPASS_ALLOWED_PLAN_IDS=
ADDONPASS_MANAGEMENT_URL=https://addonpass.com/subscriptions

import {
  AddonPassVerifier,
  createNodeStremioHandler,
} from "@addon-pass/sdk";

const verifier = new AddonPassVerifier({
  apiBaseUrl: process.env.ADDONPASS_API_URL,
  integrationCredential: process.env.ADDONPASS_INTEGRATION_CREDENTIAL,
  allowedPlanIds: process.env.ADDONPASS_ALLOWED_PLAN_IDS
    .split(",")
    .map((id) => id.trim()),
});

const handle = createNodeStremioHandler({
  access: {
    addonId: "com.example.private-addon",
    addonName: "Private Addon",
    managementUrl: process.env.ADDONPASS_MANAGEMENT_URL,
  },
  verifier,
  upstream: handleYourStremioRequest,
});

# Add AddonPass paid access to this addon

You are integrating the `@addon-pass/sdk` npm package into this Stremio addon server so only paying subscribers can use it. Follow these instructions exactly. Do not invent SDK APIs; if something here disagrees with the installed package, the package wins.

## Before writing code
1. Detect the server framework from package.json: Node `http`, a Fetch-style runtime (Request in, Response out: Next.js route handlers, Hono, Workers), Express 5, or Fastify 5. The SDK is ESM-only and needs Node 22.14 or newer.
2. Install it: `pnpm add @addon-pass/sdk` (use the project's package manager).
3. Read `node_modules/@addon-pass/sdk/AGENTS.md` if it exists, then the package README and its `.d.ts` types. They describe the installed version.

## Configuration (server-side only)
- `ADDONPASS_API_URL=https://api.addonpass.com`
- `ADDONPASS_INTEGRATION_CREDENTIAL`: this addon's credential from the AddonPass dashboard (`ap_live_…` for Base, `ap_test_…` for Base Sepolia). Use a placeholder; the developer sets the real value. Never commit it, log it, or send it to a browser.
- `ADDONPASS_ALLOWED_PLAN_IDS`: comma-separated plan IDs from the addon page. Empty is fine until a paid plan exists.
- `ADDONPASS_MANAGEMENT_URL=https://addonpass.com/subscriptions`

## Wire it up
- Create one `new AddonPassVerifier({ apiBaseUrl, integrationCredential, allowedPlanIds })` per process. Split the plan IDs on commas, trim them, and drop empty entries.
- `access` is `{ addonId, addonName, managementUrl }`; reuse the manifest's `id` and `name`.
- Choose one adapter:
  - Node `http`: `createNodeStremioHandler({ access, verifier, upstream })` from `@addon-pass/sdk`.
  - Fetch runtimes: `createFetchStremioHandler({ access, verifier, upstream })` from `@addon-pass/sdk`.
  - Express 5: `app.use(createExpressStremioMiddleware({ access, verifier }))` from `@addon-pass/sdk/express`, before every Stremio route. Read the decision with `expressAddonPassAuthorization(res)`.
  - Fastify 5: `createFastifyStremioProtection({ access, verifier })` from `@addon-pass/sdk/fastify`. Register every protected route under `/addonpass/:token/…` with `preHandler: protection.preHandler`.
- Subscribers install `https://YOUR_HOST/addonpass/{token}/manifest.json`. The SDK checks the token, removes the `/addonpass/{token}` prefix, and the existing handlers see the usual `/manifest.json`, `/catalog/…`, `/meta/…`, `/stream/…`, `/player/…` and `/library/…` paths.

## Rules
- Protect manifest.json, catalog, meta and stream, plus the player and library events if the manifest declares them (SDK 0.1.10 or newer). Nothing paid may be reachable without a token: remove or protect any public Stremio `/manifest.json` and any copy of these routes on another path, port or host.
- No redirects on these paths (http to https, trailing slash, www). Serve them over HTTPS on port 443, as `application/json`, without compression on the manifest.
- Don't add your own entitlement cache, and don't log URLs that contain the token.
- Only change what this integration needs.

## AddonPass dashboard values
- Addon server URL: `https://YOUR_HOST/addonpass/`. Use the protected base path, not the site root; a website `/manifest.json` at the root fails the live check.
- Install URL template: `https://YOUR_HOST/addonpass/{token}/manifest.json`

## Verify before finishing
- Run the server and request `/addonpass/manifest.json` and `/addonpass/<random 43-character base64url>/manifest.json`. Both must return 404 (401 or 403 also pass).
- Tell the developer to set the real credential, deploy over public HTTPS, and run the live integration test in the AddonPass dashboard.
- Add this line to the repo's AGENTS.md (create it if missing, and a CLAUDE.md containing `@AGENTS.md` if the project uses Claude Code): "AddonPass protects this addon. Read node_modules/@addon-pass/sdk/AGENTS.md before changing routes, access checks or AddonPass settings."
- Summarize what you changed and which environment variables must be set.