In this article
After reading, you'll understand:
- What each control actually blocks, and where it stops
- How domain restriction stops a lifted embed
- When token authentication beats a password
- Which control to switch on first
What is video access control?
Access control is everything that happens before playback: the checks that decide whether this viewer, on this page, at this moment, is allowed to start the stream. It is a separate layer from encryption. DRM assumes the viewer got in and protects the file anyway; access control tries to stop the wrong viewer getting in at all.
Most leaks are not sophisticated. A course link forwarded to a group chat, an embed copied onto someone else's landing page, one login shared across a team — those are access-control problems, and they are cheaper to close than to trace after the fact.
The controls, and what each one stops
| Control | Stops | Does not stop |
|---|---|---|
| Domain restriction | Your embed playing on a site you did not approve | Someone opening the stream URL directly |
| Signed URL with expiry | Hotlinking and forwarded links, once the window closes | A download taken while the link is still valid |
| Token authentication | Access after entitlement is revoked in your own system | Sharing within an active, valid session |
| Password / one-time code | Casual access by anyone without the code | The code being passed on with the link |
| Geo and IP limits | Playback outside a licensed territory or network | Anyone using a VPN |
| SSO | Access by anyone outside your directory | A logged-in user recording their screen |
Domain restriction and signed URLs cover the two most common leaks and cost the viewer nothing — no login, no friction.
Domain restriction, in practice
You give the platform a list of domains where the embed may run. The player checks the page it has been loaded into against that list, and refuses to play anywhere else. Copy the embed code onto another site and it shows a blocked player instead of your video.
This is the single most useful setting for anyone selling access to video, because the failure it prevents is the one that actually happens: an embed lifted from a sales page or a members area onto a site you have never heard of. It takes one setting and the legitimate viewer never notices it.
Its boundary is equally clear. Domain restriction governs the page, not the stream. Someone who opens the network tab and takes the media URL is outside its reach — that is what signed URLs are for, and beyond them, DRM.
Token authentication versus a password
A password is a shared secret: once it travels, it works for everyone who has it, and you cannot take it back from one person. Token authentication moves the decision into your own backend. Your application asks "is this viewer entitled right now?", and only then does the player receive a short-lived token to exchange for playback.
The practical difference shows up at cancellation. With a password, a lapsed subscriber keeps watching until you rotate the password for everyone. With tokens, the next request simply fails, and nobody else is disturbed.
What to switch on first
One setting, closes the most common leak, invisible to real viewers. Start here regardless of what else you do.
Add when links get forwarded, or when the media URL is discoverable from the page.
Add when entitlement lives in your own product — subscriptions, seats, course enrolment.
Add when the file itself must be unusable off-platform, and when you need to know which viewer a leaked copy came from.
Skipping straight to DRM is a common and expensive mistake. DRM does nothing about an embed republished on another site — that is a domain rule, and it is free.
How Kinescope handles this
Domain restrictions, signed links with an expiry, password and one-time codes, IP and geographic rules and SSO are all part of the platform rather than a security add-on tier, and they combine — a video can require an approved domain and a signed link and an entitlement check from your backend. Video access control covers the rules engine; private video hosting covers the whole picture.
Read the Kinescope docsFrequently asked questions
What is video access control?
The set of rules that decide who is allowed to start a video, applied before playback begins. In practice it means some combination of approved domains, expiring signed links, geographic or IP limits, a password or one-time code, and single sign-on against your own user database.
What is domain restriction for private videos?
A rule that ties an embed to a list of domains you approve. The player checks the page it is running on against that list and refuses to play anywhere else — so if someone copies your embed code onto their own site, they get a blocked player instead of your video. It is the cheapest way to stop an embed being lifted, and it costs the viewer nothing.
Is domain restriction enough on its own?
No. It governs where the embed may run, not what happens to the file. Someone who reaches the stream URL directly is outside its reach — that gap is closed by signed URLs with an expiry, and by DRM if the file itself must stay encrypted.
What is a signed URL?
A link that carries a cryptographic signature and an expiry time. The delivery layer checks both before serving anything, so a link copied out of the page stops working after the window closes. It is the standard answer to hotlinking and to links being forwarded.
What is token authentication for video?
Your own backend decides whether a viewer is entitled, then issues a short-lived token the player exchanges for playback. The advantage is that entitlement stays in your system — a cancelled subscription or a revoked seat takes effect on the next request, without touching the video platform.
What is geo-blocking and when is it worth using?
Restricting playback by the viewer's country, usually resolved from their IP. It exists because distribution rights are sold by territory, so it matters for licensed media. For a course or corporate library it rarely earns its place: it inconveniences travelling staff and is trivially bypassed with a VPN.
Which control should I start with?
Domain restriction, because it is one setting and stops the most common leak — your embed appearing on someone else's page. Add signed URLs when links get forwarded, token authentication when entitlement lives in your own product, and DRM when the file itself must be unusable off-platform.
Further reading
- Signed URL — how the expiring-link half works.
- DRM — what protects the file after access is granted.
- Watermarking — how a leak gets traced to a viewer.
- Private video hosting — the controls applied end to end.
- Video access control at Kinescope — domain, token and session rules.
- What is anti-piracy? — where access control sits among the other methods.
Read next
Signed URL
A playback link carrying an expiry and a cryptographic token — it stops working once the window closes, and a tampered link never…
Read →SecurityDRM
Encryption of the video file plus a licence server that issues a per-session key — so a downloaded copy stays unplayable.
Read →SecurityMulti-DRM
Serving one encrypted library through Widevine, FairPlay and PlayReady at once — no single DRM system covers every browser and…
Read →