Signed links

Signing key#

1. Go to Settings → Signing keys → Create key.
2. Save the secret: it is shown once, when the key is created. Treat it like a database password and never send it to the browser — sign on the server only.
3. The key has an ID, sk_…, which goes into the token header.

A revoked key stops working within a minute, and so do the links signed with it.

Token#

A standard JWT signed with HS256:

header:  { "alg": "HS256", "typ": "JWT", "kid": "sk_your_key_id" }
payload: { "code": "abc123XYZ0", "iat": 1791676800, "exp": 1791678600 }

• code is the code of the video, playlist, broadcast or channel. A token for one won't open another.
• iat and exp are required; the lifetime is 24 hours at most.
• You can sign only your own content.
• Use the secret in the signature as a string, exactly as the console gave it to you.

// Node.js, jsonwebtoken library
import jwt from 'jsonwebtoken'

const token = jwt.sign({ code: 'abc123XYZ0' }, process.env.DODOCAST_SECRET, {
  algorithm: 'HS256', keyid: 'sk_your_key_id', expiresIn: '30m',
})
const url = `https://stream.dodocast.com/s/${token}/hls/mp4/abc123XYZ0/master.m3u8`

# Python, PyJWT library
import time, jwt

now = int(time.time())
token = jwt.encode({"code": "abc123XYZ0", "iat": now, "exp": now + 1800},
                   SECRET, algorithm="HS256", headers={"kid": "sk_your_key_id"})
url = f"https://stream.dodocast.com/s/{token}/hls/mp4/abc123XYZ0/master.m3u8"

The Player SDK has this built in: signToken(), signedStreamUrl(), signedPlaylistItemUrl() from @dodocast/player/server.

Where the token goes#

The token goes into the link path. The player requests the renditions, segments and encryption key with the same prefix on its own.

If a link returns 403#

• you signed someone else's content — a key works only for your own;
• exp minus iat is more than 24 hours;
• the token has a purpose field — it must not;
• the key was revoked (or recreated — check kid);
• your server's clock is more than 5 minutes fast.