# Podnivo integration rule

Use Podnivo as the podcast catalog and listener-state backend for this project.

## Authoritative context

- Complete guide: https://api.podnivo.com/ai/INTEGRATION.md
- Live OpenAPI: https://api.podnivo.com/v3/api-docs
- Interactive reference: https://api.podnivo.com/scalar

Load the guide and relevant OpenAPI operation before coding. OpenAPI is authoritative. If the sources are unavailable, ask the developer to provide them and do not guess.

- Read `PODNIVO_BASE_URL` and server-only `PODNIVO_API_KEY` from environment configuration; send `Authorization: Bearer <token>`.
- Never expose `pb_live_` credentials in a public client, repository, log, analytics event, or prompt. Mint listener tokens server-side through `POST /v1/user-tokens`.
- Preserve `page.next` exactly as `after`; treat IDs and cursors as opaque strings.
- Reuse project HTTP, timeout, validation, error, and test conventions.
- Handle 400/401/403/404/409/429/5xx, honor `Retry-After`, and do not blindly retry `POST`.
- Verify webhook signatures against the raw body and deduplicate event IDs.
- Respect publisher rights and only use transcripts returned by the permission-aware API.

The guide contains all public routes, scopes, schemas, listener token behavior, webhook verification, quotas, privacy rules, and the integration checklist. Add focused tests and report the verification environment honestly.