Build a partner-facing content API that lets approved companies read public short‑video metadata reliably and fairly. Access must be protected and usage capped per partner so no one can crowd out others. Implement this as REST endpoints on Node.js/Koa, with a middleware that checks an API key plus an HMAC signature on every call. After authentication, apply per‑key rate limiting backed by Redis (token bucket or fixed window using INCR on keys like rate_limit:{api_key}); return 429 Too Many Requests when a partner exceeds its window. Serve the metadata from our primary MySQL database.