VdoCipherToken Authentication
Token authentication gates video playback behind short-lived, per-user credentials, typically a signed JWT, instead of static URLs. The backend issues a token encoding who the viewer is, which video, and an expiry; the video service validates it before serving a license or manifest. Done properly, tokens cannot be reused after expiry.
What is Token Authentication?
Token authentication gates video playback behind short-lived, per-user credentials, typically a signed JWT, instead of static URLs that work for anyone who holds them.
How It Works
Your backend issues a token that encodes who the viewer is, which video they may watch, and an expiry time, all signed with a secret. When the player requests a manifest or a DRM license, the video service validates the token's signature and claims before responding. Because entitlements are checked server-side, which courses a user bought is enforced where the client cannot tamper with it.
Why It Matters
- No reusable links: A token that has expired cannot be replayed, unlike a static URL.
- Hard to lift: Done properly, a token pulled from DevTools is useless once expired or bound to context.
- Server-side entitlement: Access rules live on your backend, not in the page.
Token Auth vs DRM
Token authentication controls who may start playback; DRM controls whether the delivered stream can be decrypted and copied. Strong platforms use both, with tokens (or one-time OTPs) gating each session and DRM protecting the stream itself.