Is a secure token the same as DRM?

No. A secure token controls who can load a URL and for how long. Once a file is downloaded, the token no longer protects it. DRM keeps the video encrypted and needs a license for every play. Use tokens to stop link sharing and hotlinking, and Multi-DRM for paid or studio content.

Will signed URLs slow down delivery?

No. Tokens are validated at the 5centsCDN edge in milliseconds, with no round-trip to your origin on each request.

Do I need to change my video player?

No. The token travels in the URL your app hands out, so your existing players keep working. You only add a signing step in your backend.

What happens when a token expires mid-stream?

It depends on your session policy. With Fixed, the session ends at the token's expiry time, so set the expiry longer than your longest expected viewing. With Moving, the session stays valid as long as the player keeps requesting within the expiry window, which suits long and live viewing.

Which mode should I use for HLS and DASH?

Partial path with the token in the path. Sign the stream's folder once and every segment request under it is authorized, without re-signing each .ts or .m4s file.

Can I protect my AES encryption key with a token?

Yes. Put a secure token in front of your AES key URL so only authorized sessions can fetch the key.

How do I rotate my secret without breaking live links?

Generate a new secret in the dashboard and update your signing function. Your players don't need to be redeployed. Keeping expiry windows short means links signed with the previous secret are replaced quickly.

Multi-DRM Token Authentication

AES Encryption

Secure token authentication, built into every URL you deliver

Q: Can I bind a link to one viewer or IP?

Yes. Turn on client-IP binding and the viewer's IP is folded into the token, so a copied link won't work from another address. Excluded IPs let trusted networks, such as your office or monitoring, skip the check.

Sign every link with a short-lived token that's checked at the edge. No origin round-trip and no player changes. Decide who can load your content, from which IPs, and for how long.

Get Started

Tokens validated at the edge in milliseconds, with no extra infrastructure to run.

Full pathToken in queryToken in pathIP binding

How your links stay protected

Request arrivesSigned URL from your app

Token checked at the edgeSecret + expiry + path, optional IP

AllowedContent served

200

DeniedBlocked at the edge

403

Your secret never appears in the URLExpired links stop working on their ownNo call back to your origin to authorize

Stop hotlinking at the link, before it reaches your origin

A secure token is a signed, time-limited code attached to your URL. When the request reaches the edge, 5centsCDN recomputes the token from your secret key and the request details. If the link is expired, altered, or coming from the wrong place, the file does not load.

Validation happens at the edge, so there is no round-trip to your origin on each request, and the check adds milliseconds rather than latency. Your application signs the URL; the network enforces it.

Token: The signature added to your URL, generated from your secret.
Secret: Your private key. Used to sign and to validate, never exposed in the URL.
Expiry: How long the signed link stays valid, in seconds.
Edge validation: The token is checked at the 5centsCDN edge, not on your server.

Edge checkPick a request to see what the edge does

https://cdn.example.com/courses/module-3/lesson-04.mp4?token=Qm9hY2…9f3e&expires=1792540800

Token matches your secretmatch
Link has not expired4m 12s left
Path is unchanged/module-3/
Client IP matches (IP binding on)198.51.100.24

200 OK · Content servedValidated at the edge in milliseconds.

Three levels of protection, one network

Signed links, AES encryption and Multi-DRM build on each other. Start with the level your content needs and step up when it needs more.

You're here

Signed or token URLs

Basic

StopsLink sharing and hotlinking
Gets throughAnyone who downloads the file keeps a playable copy

AES HLS encryption

Standard

StopsDirect file downloads
Gets throughThe key can be pulled from the browser with basic tools

AES Encryption

Multi-DRM

For paid content

StopsDownloading, ripping and key extraction
HowKeys never leave the device's secure module, and every play needs a license

Multi-DRM

Protecting paid content? Step up to AES Encryption or Multi-DRM.

From URL to protected link in three steps

Zone

media.example.com · HTTP Pull

Secure TokenValidate every request at the edge

Mode

Full pathSingle files

Partial path · token in queryFolders

Partial path · token in pathHLS & DASH

No origin changes. Signing is a few lines in your backend.

One token, three ways to carry it

Choose how much of the URL each token covers. The secret and expiry work the same in every mode.

Strictest

Full pathThe token covers the exact URL

Best for single files and downloads, where the link points at one asset.

https://cdn.example.com/downloads/annual-report.pdf?token=…&expires=…

Covers/downloads/annual-report.pdf

Best for: downloads, single assets

Folder

Partial pathToken in query

The token covers a directory and rides as a query parameter. Good when a signed parent link should authorize everything under it.

https://cdn.example.com/courses/module-3/lesson-04.mp4?token=…

Covers/courses/module-3/

Best for: libraries and course folders

Best for HLS & DASH

Partial pathToken in path

The token sits inside the URL path, so every segment under the same folder is already authorized without re-signing each .ts or .m4s.

https://cdn.example.com/token=…/live/channel-1/seg_00042.ts

Covers/live/channel-1/

Best for: live and on-demand streaming

Streaming video? Partial path (token in path) is usually right: sign once, and every segment follows. URLs above are illustrative.

Tune exactly how strict you want to be

Session policy: Fixed vs Moving

Fixed keeps the link valid until the token's expiry time, regardless of activity. Moving keeps it valid while the viewer keeps requesting within the expiry window; each in-window request extends it.

Session validRequest servedRequest refused

The session ends at the token's expiry time, even while the viewer is still active.

Token expiration

Set how many seconds a link stays valid. Short windows for live and premium, longer for general delivery.

Client-IP binding

Fold the viewer's IP into the token so a copied link won't work from another address.

Excluded IPs

Whitelist trusted IPs, such as your office, partners or monitoring, to skip token checks.

Secret rotation

Rotate your signing secret without redeploying your player.

Protect your AES key URL

Put a secure token in front of your AES key endpoint so the key itself can't be fetched freely.

Pairs with AES Encryption

Works with your stack

Setup is a signing function, not an integration. Keep your existing players and backend, and generate signed URLs from your app.

01Your backend

Your app signs the URL

A few lines with your secret, path and expiry. Signed locally, with no API call per link.

Players request as usual

No SDK and no player changes. The token simply travels in the URL.

The edge enforces it

Every request is validated at the 5centsCDN edge, with no call back to your origin.

Signing examples

PythonPHPC#Node.js

Developer resources

Ready-to-run token signing examples in Python, PHP, C# and Node.js
One-click secret generation and rotation

Built for anyone guarding a link

Download and file protection

Stop paid files and assets from being shared as open links.

Full pathShort expiry

Live and VOD hotlink protection

Keep other sites from embedding your streams on their traffic.

Token in pathIP binding

Members and paywalled content

Hand signed links only to logged-in users, expiring with the session.

Session policyExpiry

API and media delivery

Time-box access to media endpoints without building your own auth layer.

Time-limited URLs

Have some questions
before getting started?

Lock down your URLs without adding a vendor

Turn on secure tokens where you already deliver. One dashboard, one bill, validated at the edge.

Get Started

Login

Secure token authentication, built into every URL you deliver

Stop hotlinking at the link, before it reaches your origin

Three levels of protection, one network

Signed or token URLs

AES HLS encryption

Multi-DRM

From URL to protected link in three steps

One token, three ways to carry it

Full pathThe token covers the exact URL

Partial pathToken in query

Partial pathToken in path

Tune exactly how strict you want to be

Session policy: Fixed vs Moving

Token expiration

Client-IP binding

Excluded IPs

Secret rotation

Protect your AES key URL

Works with your stack

Your app signs the URL

Players request as usual

The edge enforces it

Signing examples

Developer resources

Built for anyone guarding a link

Download and file protection

Live and VOD hotlink protection

Members and paywalled content

API and media delivery

Have some questions
before getting started?

Lock down your URLs without adding a vendor

Products

Solutions

Compare

Tools

Resources

Company

Subscribe to our newsletter

Secure token authentication, built into every URL you deliver

Stop hotlinking at the link, before it reaches your origin

Three levels of protection, one network

Signed or token URLs

AES HLS encryption

Multi-DRM

From URL to protected link in three steps

One token, three ways to carry it

Full pathThe token covers the exact URL

Partial pathToken in query

Partial pathToken in path

Tune exactly how strict you want to be

Session policy: Fixed vs Moving

Token expiration

Client-IP binding

Excluded IPs

Secret rotation

Protect your AES key URL

Works with your stack

Your app signs the URL

Players request as usual

The edge enforces it

Signing examples

Developer resources

Built for anyone guarding a link

Download and file protection

Live and VOD hotlink protection

Members and paywalled content

API and media delivery

Have some questionsbefore getting started?

Lock down your URLs without adding a vendor

Products

Solutions

Compare

Tools

Resources

Company

Subscribe to our newsletter

Have some questions
before getting started?