Designing playback tokens that survive the real world
Signing a video URL sounds easy: HMAC the path, add an expiry, done. Then reality arrives — CDNs cache aggressively, viewers roam between networks mid-stream, and a token that's too strict breaks playback while one that's too loose protects nothing.
What a token has to balance
Our playback tokens carry an expiry, and optionally an IP or country restriction. The tension is with caching: if every viewer gets a unique URL, the CDN can't share segments between them.
The fix is to sign the session, not the segment. The token authorises a manifest; segment URLs stay stable and cacheable.
Roaming and expiry
IP pinning is the most common foot-gun. A viewer on mobile who switches from Wi-Fi to cellular changes IP mid-stream — pin too tightly and the stream dies. We pin to a network prefix, not a single address, and keep TTLs short enough to matter but long enough to outlast a typical view.
POST /v1/playback-tokens
{ "asset": "ast_5c19be20", "ttl": 3600,
"restrict": { "country": ["PL","DE"] } }
Verify server-side, always
Tokens are minted with your secret key on your server, never in the browser. The same rule applies to webhook signatures: verify the Rezeis-Signature HMAC in constant time before you trust a payload. A bearer credential in client code is not a credential — it's a giveaway.