Signed URL

A playback link with a cryptographic signature and an expiry time attached. The server checks the signature before serving anything, so a copied link stops working once its window closes — and a tampered one never worked at all.

Updated: July 2026 5 min read Security
In short

A signed URL bakes an expiry and a secret-key signature into a video link, so a copied or altered link is refused before any video is served — but does nothing once a valid stream has begun.

What is a signed URL?

A signed URL is an ordinary media link with extra parameters appended: an expiry timestamp, optionally a set of constraints, and a signature computed over all of it with a secret key. The edge server recomputes that signature on every request. If it does not match, or the clock has passed the expiry, the request is refused before a single byte of video is sent.

You will also see the same idea called a tokenised URL, a pre-signed URL (the term Amazon S3 uses) or simply link signing. The mechanics are the same: authorisation is carried inside the link rather than in a session on the server. In practice the signature usually covers the manifestManifestA small index file (.m3u8 or .mpd) that lists every available rendition and segment so the player knows what it can request.Open definition → and its segments alike.

How signing works

Your server decides

A viewer asks to watch. Your backend checks entitlement — subscription, purchase, seat — and only then decides to issue a link.

The token is computed

An HMAC is calculated over the path, the expiry and any constraints, using a secret key that never leaves your infrastructure or the platform's.

The link is handed out

The token and expiry ride along as query parameters. The link is valid from that moment until it lapses — usually minutes, not days.

The edge verifies

Every request to the CDNCDN (Content Delivery Network)A global network of edge servers that caches video close to viewers, cutting latency and absorbing traffic spikes.Open definition → is re-checked against the signature. Wrong key, edited path or expired window all return an error instead of video.

Because verification happens at the edge, signing costs nothing in latencyLatencyThe delay between a moment happening and a viewer seeing it. Critical for live — Low-Latency HLS brings it down to 2–5 seconds.Open definition → and needs no round trip to your backend during playback. The check is arithmetic, not a database lookup.

What you can bind a link to

ConstraintWhat it meansTrade-off
Expiry The link dies at a fixed timestampShort windows are safer but break resumed playback if too aggressive
IP addressOnly the requesting IP may playMobile viewers switching between WiFi and cellular get cut off
User or session IDThe token carries who it was issued toRequires your backend to mint links per viewer
Path or prefixThe signature covers a specific asset or folderA per-asset signature is stricter; a prefix is easier to operate

Expiry plus a per-viewer identifier is the combination most teams settle on. IP binding sounds strongest and causes the most support tickets.

What signing stops — and what it does not

Signing controls distribution of the link. It says nothing about what happens to the video once playback has legitimately begun.

ThreatDoes signing stop it?Why
A link pasted into a group chatYes, after expiryThe token lapses; late arrivals get an error
Hotlinking your file from another siteYesThe signature is bound to your parameters, not theirs
Scraping predictable file URLsYesThere is no valid link without the secret key
Downloading during the valid windowNoThe bytes are being served legitimately — only DRMDRMEncryption of the video file plus a licence server that issues a per-session key — so a downloaded copy stays unplayable.Open definition → makes them unusable afterwards
Recording the screenNoNothing in the link layer touches playback

That last pair is the reason signed links and DRM are not alternatives. Signing decides who may start a stream; DRM decides whether the delivered file is worth anything once it lands.

Signed URLs versus the other controls

Password or login

Guards the page. Once the player is loaded, the HLSHLS (HTTP Live Streaming)Apple’s adaptive streaming protocol. Uses .m3u8 manifests and segmented delivery; supported on every browser, device and smart TV.Open definition → media URL is visible in developer tools and works for anyone who copies it — unless it is signed.

Domain restriction

Stops your embed playing on other sites, but does nothing about a direct link to the file itself.

Signed URL

Makes the direct link temporary and non-transferable. The gap it leaves is what happens during the valid window.

DRM

Encrypts the payload so a download taken inside that window is still unplayable. The layer below the link.

Further reading

Denis Konnov

Written by

Denis Konnov Verified

CMO at Kinescope

Denis leads marketing and content at Kinescope, working closely with the platform's engineers. This glossary is reviewed and kept up to date by the team building Kinescope's streaming, encoding and CDN delivery infrastructure.

FAQ

Can’t find the answer you need? Check out our Help Center.

A media link carrying an expiry timestamp and a cryptographic signature. The server recomputes the signature on each request and refuses anything expired or altered, so the link works only for its intended window.

Minutes rather than hours for the manifest, with the player refreshing as needed. Long windows are convenient and are exactly what gets pasted into group chats; very short ones break resumed playback and long pauses. Most teams land between five minutes and an hour.

No. While the link is valid the bytes are served normally, so anything that can play the stream can also save it. Signing controls access to the link; DRM controls whether a saved copy is usable.

They solve different halves. Signed links stop hotlinking, scraping and sharing after expiry; DRM makes a captured file unplayable. For paid content the sensible answer is both, with signing as the cheap outer layer.

Yes, if the token includes a user or session identifier your backend supplies. That also makes leaks attributable, since a link that surfaces publicly points back to the account it was minted for.

Usually not. It sounds like the strongest constraint but breaks the moment a phone switches from WiFi to cellular, or a corporate network rotates its egress addresses. Expiry plus a per-viewer identifier gives most of the benefit with far fewer support tickets.