LightBurn / MillMage REST API (1.0.0)
REST API for LightBurn and MillMage. Provides file upload and import, read-only project and machine-state queries, cut-setting edits, and real-time state streaming via Server-Sent Events.
All endpoints except POST /api/connect and GET / require a Bearer token derived from a shared secret using HMAC-SHA256:
token = hex(HMAC-SHA256(secret, floor(unix_time / 60)))
The server accepts tokens for the current minute and the previous minute to handle clock drift.
Obtain a shared secret by pairing a local application:
- Local application pairing (
POST /api/connect): For localhost applications only. Sends anapplication_namein the request body. The application user is shown a consent dialog every time; if approved, a new secret is generated and returned. The dialog has a 30-second timeout after which the connection is automatically declined. Applications are responsible for persisting their own secret. Each call produces a distinct secret, even for the sameapplication_name.
The port is served by one running copy of the application at a time. If several copies are open, the one most recently brought to the foreground serves it; switching windows moves the listener, and a request made during the switch may fail to connect. Retry.
A secret is recognised by the copy that was running when you paired, and may not be recognised by another copy until that one reloads its settings. If a previously working secret starts returning 401 on a machine with several copies open, pair again rather than assuming it was revoked.
Neither applies to a single running instance, which serves the port for as long as it is open.