The ERC721 Media API provides a standardized approach for allowing third party access to media files for ERC721 NFTs if the owner gives permission.

Example of media files are:

1. Rigged 3D models in VRM, FBX and GLB formats to be used in open worlds such as Cryptovoxels, Sandbox, Decentraland or Somnium
2. 2D sprite sheets to use in 2D based worlds such as worldwideweb3

The media files in question are not stored on the blockchain, but are securely stored as part at the website of the ERC721 contract owner. An ERC721 contract owner can implement this API to provide third party access to the media files.

At a high-level, a third party application would like access to media files on behalf of the NFT owner. To prove the ownership, the NFT owner must sign a message using web3 at the website of the ERC721 contract owner. This will trigger a redirect to a callback URI defined by the third party application, and include the necessary access-token to access the media files for a limited time period.

The overall authentication flow is inspired by the OAuth Authorization Code Flow, but is simpler (access_token returned in initial callbackURI).

The first step is the endpoint /authorize which initialize the flow from the third party application. The third party application must provide a callbackURI and is recommended to provide a state parameter for preventing cross-site request forgery attacks.

The results of the first step is a HTTP 302 redirect to a URI at the website of the ERC721 contract owner. This redirect includes the callbackURI and state from the third party application.

By following the redirect, the NFT owner will need to sign a message using web3 to prove ownership. If the authentication through web3 signature was completed successfully, the callback URL will be triggered with three parameters:

account: The account address that approved access.
access-token: The token that grants access to the owner files.
state (optional): Optional state parameter which should be compared with  in order to protect against cross-site request forgery

If authentication was not successful, for example the user cancelled the request, the callback URL will be triggered with a single parameter:

error-message: The message describing the error that occured, or that the user declined access.

Available media files are found through /nfts. This endpoint may require a valid access-token.

Media files are downloaded from /nfts/{nft-id}/media/{media-id}. This endpoint will always required a valid access-token.

Currently, the access-token is passed around as a query parameter. This can have security implications. Bearer based authentication via Authorization HTTP header ought to be defined as an alternative.

Ideally, there should be a reference from the Ethereum smart contract to this API. However, it will not be feasible to adjust existing contracts with this information. New contracts are encouraged to provide a tokenMediaURI function which returns the base URI of the ERC721 Media API implementation for the contract.