How a signed URL works
When an entitled viewer presses play, the streaming service builds the stream address and adds a token: an expiry time and any restrictions, signed with a secret key that only the service and the CDN know. The CDN recomputes the signature on each request. If anything in the URL was altered, or the time has passed, it refuses.
What a token can restrict
- Time: valid for minutes or hours
- Path: only this title, or this rendition
- IP address or network: only the device that requested it
- Country: only licensed territories
- Session or user: tied to a single playback session
What it prevents
Without it, a stream address works for anyone who has it, forever. One subscriber could post the link and the whole internet could watch at your expense. Signed URLs stop link sharing, hotlinking from other sites and automated scraping of your catalog.
Signed URLs and DRM
They solve different problems and are used together. A signed URL controls who may fetch the stream. DRM controls who may decrypt it and what the device may do with it. A viewer with a valid token can still record an unencrypted stream, which is why licensed content adds DRM.
Tokens must be short-lived enough to be useless when shared, yet renewable during a long film or a live event without interrupting playback.
Last reviewed