All,
I have tried for a while to get a response from Roku - I'm hoping someone here can help with this one. I am trying to use the Roku push notifications. I am successfully receiving them, but I would like to acknowledge them and stop the same notification from coming over and over again.
From the documentation:
"When a qualifying event occurs, Roku attempts to send the notification every few seconds. If the notification is not successfully delivered within a reasonable time period, Roku removes it."
In reality, I am seeing that Roku attempts to send the notification every hour for a week. In the API, they talk about responding to the message and make a mention of some "security" they have implemented to prevent someone from "crashing the Roku system". It says to "The partner must return this (responseKey) and only this in the response content." later on, it says "Additionally, you are required to send an ApiKey header with the value containing your Roku API key". I have tried doing this. My response has a header with apikey-> (actual api key) and the response message is in JSON as {"responseKey":(actual response key)}.
Has anyone set this up successfully? What am I missing?
It also seems very insecure that Roku is requiring us to respond to a message with our API key in the header. Anybody could send a properly formatted message to the route we are listening on and get our API key back. I could whitelist the IP addresses, but there are a bunch that the notifications are coming from and Roku doesn't list them anywhere. I'm wondering if most people verify the transaction id with Roku before acknowledging the message. This seems like an unnecessary extra trip to the Roku server each time. My $0.02 - there should be an "acknowledge message" endpoint where you do a simple post to "/(actual API key)/(actual response key)" to acknowledge messages.
