Signed URL
A playback link with a cryptographic signature and an expiry time attached. The server checks the signature before serving anything, so a copied link stops working once its window closes — and a tampered one never worked at all.
A signed URL bakes an expiry and a secret-key signature into a video link, so a copied or altered link is refused before any video is served — but does nothing once a valid stream has begun.
What is a signed URL?
A signed URL is an ordinary media link with extra parameters appended: an expiry timestamp, optionally a set of constraints, and a signature computed over all of it with a secret key. The edge server recomputes that signature on every request. If it does not match, or the clock has passed the expiry, the request is refused before a single byte of video is sent.
You will also see the same idea called a tokenised URL, a pre-signed URL (the term Amazon S3 uses) or simply link signing. The mechanics are the same: authorisation is carried inside the link rather than in a session on the server. In practice the signature usually covers the manifestManifestA small index file (.m3u8 or .mpd) that lists every available rendition and segment so the player knows what it can request.Open definition → and its segments alike.
How signing works
A viewer asks to watch. Your backend checks entitlement — subscription, purchase, seat — and only then decides to issue a link.
An HMAC is calculated over the path, the expiry and any constraints, using a secret key that never leaves your infrastructure or the platform's.
The token and expiry ride along as query parameters. The link is valid from that moment until it lapses — usually minutes, not days.
Every request to the CDNCDN (Content Delivery Network)A global network of edge servers that caches video close to viewers, cutting latency and absorbing traffic spikes.Open definition → is re-checked against the signature. Wrong key, edited path or expired window all return an error instead of video.
Because verification happens at the edge, signing costs nothing in latencyLatencyThe delay between a moment happening and a viewer seeing it. Critical for live — Low-Latency HLS brings it down to 2–5 seconds.Open definition → and needs no round trip to your backend during playback. The check is arithmetic, not a database lookup.
What you can bind a link to
| Constraint | What it means | Trade-off |
|---|---|---|
| Expiry | The link dies at a fixed timestamp | Short windows are safer but break resumed playback if too aggressive |
| IP address | Only the requesting IP may play | Mobile viewers switching between WiFi and cellular get cut off |
| User or session ID | The token carries who it was issued to | Requires your backend to mint links per viewer |
| Path or prefix | The signature covers a specific asset or folder | A per-asset signature is stricter; a prefix is easier to operate |
Expiry plus a per-viewer identifier is the combination most teams settle on. IP binding sounds strongest and causes the most support tickets.
What signing stops — and what it does not
Signing controls distribution of the link. It says nothing about what happens to the video once playback has legitimately begun.
| Threat | Does signing stop it? | Why |
|---|---|---|
| A link pasted into a group chat | Yes, after expiry | The token lapses; late arrivals get an error |
| Hotlinking your file from another site | Yes | The signature is bound to your parameters, not theirs |
| Scraping predictable file URLs | Yes | There is no valid link without the secret key |
| Downloading during the valid window | No | The bytes are being served legitimately — only DRMDRMEncryption of the video file plus a licence server that issues a per-session key — so a downloaded copy stays unplayable.Open definition → makes them unusable afterwards |
| Recording the screen | No | Nothing in the link layer touches playback |
That last pair is the reason signed links and DRM are not alternatives. Signing decides who may start a stream; DRM decides whether the delivered file is worth anything once it lands.
Signed URLs versus the other controls
Guards the page. Once the player is loaded, the HLSHLS (HTTP Live Streaming)Apple’s adaptive streaming protocol. Uses .m3u8 manifests and segmented delivery; supported on every browser, device and smart TV.Open definition → media URL is visible in developer tools and works for anyone who copies it — unless it is signed.
Stops your embed playing on other sites, but does nothing about a direct link to the file itself.
Makes the direct link temporary and non-transferable. The gap it leaves is what happens during the valid window.
Encrypts the payload so a download taken inside that window is still unplayable. The layer below the link.
Further reading
- HMAC — Wikipedia — the signing primitive behind most token schemes.
- DRM — the layer that protects the payload rather than the link.
- Secure video hosting: what it means and how to choose.
- Anti-piracy for video — how signing, DRM and watermarking stack.
