Protect content with video secure tokens

By default, video links are publicly accessible and can be embedded on any website. A video secure token restricts access by embedding a signed token and an expiration timestamp in every URL — the CDN validates both on each request before serving the content. Secure token requires a custom CDN resource on a paid CDN tariff; the default clientID.gvideo.io streaming domain does not support it.

Secure tokens and access policies

Secure tokens control per-user access (WHO can watch). Access policies on a custom CDN resource control location-based access (WHERE content is available):

Requirement	Solution
Paid, private, or time-limited per-user access	Video secure token (this article)
Country restriction	Country access policy
Domain or site restriction	Referrer access policy
Network or IP restriction	IP access policy

Access policies require no backend code. Video secure tokens require a backend service that generates a signed URL for each authenticated request.

Request validation

Token validation happens on every CDN request — each stage produces a distinct HTTP response code depending on the token state.

1. The backend generates a signed URL — an MD5 hash of the content identifier (video slug or stream ID), secret key, and expiration timestamp.
2. The client uses the signed URL to request video content.
3. The CDN validates the token on every request and returns:
   • 200 OK — token is valid and has not expired
   • 403 Forbidden — token is invalid (bad signature or wrong IP)
   • 410 Gone — token is valid but has expired

The secret key is stored in the CDN resource settings and never exposed to clients.

Enable the secure token

The feature is configured in the Access section of the CDN resource settings. Complete these steps in order:

1. Activate the CDN product on a paid tariff.
2. Create a new custom CDN resource for the streaming origin — follow the Custom CDN resource guide.
3. In the CDN resource settings, navigate to the Access section and enable Secure token. Enter a key and optionally enable Add a client’s IP to the token for IP binding.
4. Contact Gcore Support to configure Streaming Rules — Support routes streaming content correctly through the custom CDN resource.

Protected URL format

A protected URL embeds the token and expiration timestamp in the path:

https://domain.com/videos|cmaf|mpegts/{account_id}_{video_id}/{token}/{expiration}/manifest.m3u8

Where:

• videos — for VOD, cmaf|mpegts — for LIVE
• {account_id} — account ID
• {video_id} — video slug (VOD) or stream ID (live)
• {token} — MD5 hash of the content identifier, secret key, and expiration
• {expiration} — Unix timestamp (seconds) at which the URL expires

The token applies to the relative path of the video or live stream. The same token therefore covers the main manifest, additional manifests, segments, and MP4 renditions.

For example, the same token and expiration remain in the path while the requested file changes:

VOD:

• https://domain.com/videos/{account_id}_{video_slug}/{token}/{expiration}/manifest.m3u8
• https://domain.com/videos/{account_id}_{video_slug}/{token}/{expiration}/segment-1-svod720n-v1-a1.ts
• https://domain.com/videos/{account_id}_{video_slug}/{token}/{expiration}/720.mp4

LIVE:

• https://domain.com/cmaf/{account_id}_{stream_id}/{token}/{expiration}/master.m3u8
• https://domain.com/cmaf/{account_id}_{stream_id}/{token}/{expiration}/index.mpd

When the token expires, the CDN returns 410 Gone. For example, requesting a URL with expiration 1755007200 (Tuesday, August 12, 2025 at 14:00:00 UTC) at 15:15 UTC on the same day:

curl -I https://demo-protected.gvideo.io/videos/2675_pG8TfmKx2LU2qs/2oY5gKMSVBBX2x-VbzN03g/1755007200/master.m3u8

HTTP/2 410
date: Tue, 12 Aug 2025 15:15:18 GMT
content-type: text/html
content-length: 136

Expiration and link sharing

The token must remain valid for the entire playback session. An expiration shorter than the video duration causes playback to fail mid-stream — new segment requests return 410 Gone. If a user pauses and returns after a long break, the signed URL must be re-acquired before playback resumes.

Long-lived tokens solve the session continuity problem but create a sharing risk: a copied URL remains valid until expiry, allowing unauthorized viewing. Short-lived tokens (60 seconds or less) with automatic refresh reduce this risk by limiting how long a copied URL remains usable.

Short-lived tokens with automatic refresh integrate with the Gcore Video Player, hls.js, and dash.js using a ready-to-deploy Gcore FastEdge token API.

Token generation

The signing method differs between streaming manifests and standalone MP4 files — HLS/DASH streams use a path-embedded MD5 formula, while MP4 files use a separate advanced formula with optional download speed limiting.

Video secure token vs. generic CDN secure token

Both token types require a custom CDN resource. They differ in signing formula and target content:

	Video secure token	Generic CDN secure token
Target content	HLS/DASH streaming, VOD, live streams, MP4	Any CDN resource content (video, images, files)
Signing scope	Relative path — one token covers manifest and all segments	Per absolute URL
MP4 support	Separate advanced token with optional download speed limiting	Not included
Documentation	This article and linked generation guides	CDN Secure Token