Skip to main content
Advanced token authentication uses SHA256 hashing and supports directory-level tokens for video streaming, country-based restrictions, and speed limits.

​
URL structure

Query parameter format: 
https://myzone.b-cdn.net/videos/playlist.m3u8?token=abc123&expires=1598024587&token_path=%2Fvideos%2F
Path-based format (useful for video delivery): 
https://myzone.b-cdn.net/bcdn_token=abc123&expires=1598024587&token_path=%2Fvideos%2F/videos/playlist.m3u8

​
Parameters

ParameterRequiredDescription
tokenYesBase64-encoded SHA256 hash
expiresYesUNIX timestamp in seconds when the URL becomes invalid (milliseconds and nanoseconds are not supported)
token_pathNoURL-encoded path prefix for directory-level access
token_countriesNoComma-separated allowed country codes (ISO 3166-1)
token_countries_blockedNoComma-separated blocked country codes
limitNoDownload speed limit in kB/s

​
Directory tokens

By default, tokens are valid only for the exact URL path. Directory tokens allow access to any file within a path prefix—essential for video streaming where players request multiple segment files. Signing with token_path=/videos/stream1/ allows access to all files in that directory: 
/videos/stream1/playlist.m3u8
/videos/stream1/segment1.ts
/videos/stream1/segment2.ts

​
Generate the token

token = Base64(SHA256(security_key + signed_path + expiration + user_ip + sorted_params))
Additional parameters must be sorted alphabetically and formatted as param1=value1&param2=value2. Do not include token or expires in the hash. After Base64 encoding, replace + with -, / with _, and remove = characters.

​
Code examples

function signUrl($url, $securityKey, $expirationTime = 3600, $userIp = '', $pathAllowed = '', $countriesAllowed = '', $countriesBlocked = '') {
    $expires = time() + $expirationTime;
    $parsedUrl = parse_url($url);
    $parameters = [];

    if (!empty($parsedUrl['query'])) {
        parse_str($parsedUrl['query'], $parameters);
    }

    $signaturePath = !empty($pathAllowed) ? $pathAllowed : $parsedUrl['path'];
    if (!empty($pathAllowed)) $parameters['token_path'] = $signaturePath;
    if (!empty($countriesAllowed)) $parameters['token_countries'] = $countriesAllowed;
    if (!empty($countriesBlocked)) $parameters['token_countries_blocked'] = $countriesBlocked;

    ksort($parameters);
    $parameterString = '';
    foreach ($parameters as $key => $value) {
        if ($key !== 'token' && $key !== 'expires') {
            $parameterString .= '&' . $key . '=' . $value;
        }
    }
    $parameterString = ltrim($parameterString, '&');

    $hashableBase = $securityKey . $signaturePath . $expires . $userIp . $parameterString;
    $token = hash('sha256', $hashableBase, true);
    $token = base64_encode($token);
    $token = strtr($token, '+/', '-_');
    $token = rtrim($token, '=');

    $parameters['token'] = $token;
    $parameters['expires'] = $expires;

    return $parsedUrl['scheme'] . '://' . $parsedUrl['host'] . $parsedUrl['path'] . '?' . http_build_query($parameters);
}

// Directory token for video streaming
$url = signUrl(
    'https://myzone.b-cdn.net/videos/stream1/playlist.m3u8',
    'your_security_key',
    3600,
    '',
    '/videos/stream1/'
);

​
Path-based tokens for video

For HLS/DASH delivery, use path-based tokens so segment requests automatically include authentication: 
https://myzone.b-cdn.net/bcdn_token=abc123&expires=1598024587&token_path=%2Fvideos%2F/videos/playlist.m3u8