> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gcore.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Protect content with video secure tokens

> Restrict video access with video secure tokens that embed a signed token and expiration in each URL for CDN validation.

By default, video links are publicly accessible and can be embedded on any website. A video secure token restricts access by embedding a signed token and an expiration timestamp in every URL — the CDN validates both on each request before serving the content. Secure token requires a custom CDN resource on a paid CDN tariff; the default `clientID.gvideo.io` streaming domain does not support it.

## Secure tokens and access policies

Secure tokens control per-user access (WHO can watch). Access policies on a [custom CDN resource](/streaming/interaction-with-cdn/custom-cdn-resource) control location-based access (WHERE content is available):

| Requirement | Solution |
| - | - |
| Paid, private, or time-limited per-user access | Video secure token (this article) |
| Country restriction | Country access policy |
| Domain or site restriction | Referrer access policy |
| Network or IP restriction | IP access policy |

Access policies require no backend code. Video secure tokens require a backend service that generates a signed URL for each authenticated request.

## Request validation

Token validation happens on every CDN request — each stage produces a distinct HTTP response code depending on the token state.

1. The backend generates a signed URL — an MD5 hash of the content identifier (video slug or stream ID), secret key, and expiration timestamp.
2. The client uses the signed URL to request video content.
3. The CDN validates the token on every request and returns:
   * **200 OK** — token is valid and has not expired
   * **403 Forbidden** — token is invalid (bad signature or wrong IP)
   * **410 Gone** — token is valid but has expired

The secret key is stored in the CDN resource settings and never exposed to clients.

## Enable the secure token

The feature is configured in the **Access** section of the CDN resource settings. Complete these steps in order:

1. Activate the **CDN** product on a **paid tariff**.
2. Create a new **custom CDN resource** for the streaming origin — follow the Custom CDN resource guide.
3. In the CDN resource settings, navigate to the **Access** section and enable **Secure token**. Enter a key and optionally enable **Add a client's IP to the token** for IP binding.
4. Contact [Gcore Support](mailto:support@gcore.com) to configure `Streaming Rules` — Support routes streaming content correctly through the custom CDN resource.

![CDN resources list showing multiple custom CDN resources for streaming](https://mintcdn.com/gcore/_SbOSGsb3RK580jq/images/docs/streaming/interaction-with-cdn/video-secure-token/cdn-resources.png?fit=max\&auto=format\&n=_SbOSGsb3RK580jq\&q=85\&s=741473faa0b9fd35d27a861f09a5933e)

## Protected URL format

A protected URL embeds the token and expiration timestamp in the path:

```sh theme={null}
https://domain.com/videos|cmaf|mpegts/{account_id}_{video_id}/{token}/{expiration}/manifest.m3u8
```

Where:

* `videos` — for VOD, `cmaf|mpegts` — for LIVE
* `{account_id}` — account ID
* `{video_id}` — video slug (VOD) or stream ID (live)
* `{token}` — MD5 hash of the content identifier, secret key, and expiration
* `{expiration}` — Unix timestamp (seconds) at which the URL expires

The token applies to the relative path of the video or live stream. The same token therefore covers the main manifest, additional manifests, segments, and MP4 renditions.

For example, the same token and expiration remain in the path while the requested file changes:

VOD:

* `https://domain.com/videos/{account_id}_{video_slug}/{token}/{expiration}/`**manifest.m3u8**
* `https://domain.com/videos/{account_id}_{video_slug}/{token}/{expiration}/`**segment-1-svod720n-v1-a1.ts**
* `https://domain.com/videos/{account_id}_{video_slug}/{token}/{expiration}/`**720.mp4**

LIVE:

* `https://domain.com/cmaf/{account_id}_{stream_id}/{token}/{expiration}/`**master.m3u8**
* `https://domain.com/cmaf/{account_id}_{stream_id}/{token}/{expiration}/`**index.mpd**

When the token expires, the CDN returns 410 Gone. For example, requesting a URL with expiration `1755007200` (Tuesday, August 12, 2025 at 14:00:00 UTC) at 15:15 UTC on the same day:

```sh theme={null}
curl -I https://demo-protected.gvideo.io/videos/2675_pG8TfmKx2LU2qs/2oY5gKMSVBBX2x-VbzN03g/1755007200/master.m3u8

HTTP/2 410
date: Tue, 12 Aug 2025 15:15:18 GMT
content-type: text/html
content-length: 136
```

## Expiration and link sharing

The token must remain valid for the entire playback session. An expiration shorter than the video duration causes playback to fail mid-stream — new segment requests return 410 Gone. If a user pauses and returns after a long break, the signed URL must be re-acquired before playback resumes.

Long-lived tokens solve the session continuity problem but create a sharing risk: a copied URL remains valid until expiry, allowing unauthorized viewing. Short-lived tokens (60 seconds or less) with automatic refresh reduce this risk by limiting how long a copied URL remains usable.

Short-lived tokens with [automatic refresh](/streaming/interaction-with-cdn/token-auto-refresh) integrate with the Gcore Video Player, hls.js, and dash.js using a ready-to-deploy Gcore FastEdge token API.

## Token generation

The signing method differs between streaming manifests and standalone MP4 files — [HLS/DASH streams](/streaming/interaction-with-cdn/generate-hls-dash-token) use a path-embedded MD5 formula, while [MP4 files](/streaming/interaction-with-cdn/generate-mp4-token) use a separate advanced formula with optional download speed limiting.

## Video secure token vs. generic CDN secure token

Both token types require a custom CDN resource. They differ in signing formula and target content:

| | Video secure token | Generic CDN secure token |
| - | - | - |
| Target content | HLS/DASH streaming, VOD, live streams, MP4 | Any CDN resource content (video, images, files) |
| Signing scope | Relative path — one token covers manifest and all segments | Per absolute URL |
| MP4 support | Separate advanced token with optional download speed limiting | Not included |
| Documentation | This article and linked generation guides | [CDN Secure Token](/cdn/cdn-resource-options/security/use-a-secure-token/about-secure-token) |