Skip to content

Media Requests

The Requests page connects Eight.ly to an Overseerr, Jellyseerr, or Seerr instance so you can see and manage your users' media requests without leaving the dashboard. Open it from Requests in the sidebar (/requests).

Requests works on any install — it talks to an external Seerr instance, so it doesn't depend on storage, virtualization, or any other feature being set up.

What the Page Shows

Once connected, the page pulls live data from your Seerr instance and groups it:

  • Pending Approval — requests waiting on a decision, each with poster, title, year, who requested it, and when.
  • Recent Requests — everything else (approved, declined, or already available), with a status badge.
  • Trending Now — a poster row of what's trending, straight from Seerr's discovery feed.

Request status is shown as Pending, Approved, Declined, or Available. Posters are loaded from TMDB.

Connecting Seerr

Click Seerr Settings in the top-right to open the configuration dialog:

  • Seerr URL — the base address of your instance, e.g. http://192.168.1.100:5055.
  • API Key — found in Seerr under Settings > General.

Click Save & Connect. Until a URL and key are saved, the page shows a "Connect Seerr" prompt instead of request data.

Your API key stays server-side

The saved key is stored at /var/lib/eightly/seerr-config.json and is never returned to the browser in full. When you reopen the dialog, the key is masked (first four and last four characters only). Saving without changing the masked key preserves the original. Reading the config requires the viewer role; changing the URL or key requires admin.

How the Proxy Works

The browser never talks to Seerr directly. Every call goes through Eight.ly's proxy at /api/seerr/api/…, which forwards the request to {your-seerr-url}/api/… and injects the X-Api-Key header on the server. This keeps your Seerr API key out of the frontend entirely.

  • Reads (GET/HEAD) require the viewer role. Anything that mutates Seerr — approving, declining, or creating requests — requires operator.
  • Every proxied request is SSRF-guarded: the resolved target is re-validated on each call, so a URL that points at an internal or private address is rejected with a bad-gateway response.
  • Only Content-* and X-Request-Id response headers are passed back to the browser.

API

Method Path Role Purpose
GET /api/seerr/config viewer Read the configured URL and masked API key
PUT /api/seerr/config admin Save the Seerr URL and API key
* /api/seerr/api/… viewer (reads) / operator (writes) Proxy to the Seerr instance with the key injected server-side

See Also