Generate signatures

This guide explains how to create a signature, and the required and optional fields for signatures.

To create a signature, you compose a string to sign, which we refer to as a signed value in this guide. The signed value includes parameters that describe the content you are protecting, the expiration time of the signed value, and so forth.

You use the signed value while creating a signature string. You create a signature string by composing the parameters for the signature, such as an asymmetric-key Ed25519 signature of the signed value.

Media CDN uses the final composed signature to help protect your content.

Supported signing formats

Media CDN supports the following signed request formats.

Format Behavior Example
Query parameters (exact URL)

Exact URL, for granting access to a specific URL.

Exact:

https://media.example.com/content/manifest.m3u8?
Expires=EXPIRATION
&KeyName=KEY_NAME
&Signature=SIGNATURE
Query parameters (URL prefix) Specifying a URLPrefix lets you sign a prefix and append the same query parameters to multiple URLs within your player or manifest generation.

What to sign:

URLPrefix=PREFIX
&Expires=EXPIRATION
&KeyName=KEY_NAME
&Signature=SIGNATURE

Replace PREFIX with the prefix to grant access to, including the scheme, host, and partial path.

Path component

Prefix: allows access to any URL with a prefix prior to the "/edge-cache-token=[...]" component.

This allows relative manifest URLs to automatically inherit the signed URL component when fetching sub-resources.

 https://media.example.com/video/edge-cache-token=Expires=EXPIRATION
&KeyName=KEY_NAME
&Signature=SIGNATURE/manifest_12382131.m3u8
Signed cookie Prefix: the cookie allows access to any URL with the prefix specified in the signed URLPrefix value.

Edge-Cache-Cookie:

URLPrefix=PREFIX:
Expires=EXPIRATION:
KeyName=KEY_NAME:
Signature=SIGNATURE

Create a signature

  1. Create a signed value by concatenating a string that contains the required signature fields and desired optional signature fields.

    If specified, URLPrefix must come first, followed by Expires, KeyName, and then any optional parameters.

    Separate each field and any parameters with the following:

    • For cookies, use a colon : character.
    • For query parameters and path components, use an ampersand & character.

  2. Sign the signed value with an Ed25519 signature.

  3. Append a field separator (either : or &) followed by Signature= and the Ed25519 signature to the end of the string.

Create a signed URL

The following code samples shows how to programmatically create a signed URL.

Go

To authenticate to Media CDN, set up Application Default Credentials. For more information, see Set up authentication for a local development environment. 

import (
	"crypto/ed25519"
	"encoding/base64"
	"fmt"
	"io"
	"strings"
	"time"
)

// signURL prints the signed URL string for the specified URL and configuration.
func signURL(w io.Writer, url, keyName string, privateKey []byte, expires time.Time) error {
	// url := "http://example.com"
	// keyName := "your_key_name"
	// privateKey := "[]byte{34, 31, ...}"
	// expires := time.Unix(1558131350, 0)

	sep := '?'
	if strings.ContainsRune(url, '?') {
		sep = '&'
	}
	toSign := fmt.Sprintf("%s%cExpires=%d&KeyName=%s", url, sep, expires.Unix(), keyName)
	sig := ed25519.Sign(privateKey, []byte(toSign))

	fmt.Fprintf(w, "%s&Signature=%s", toSign, base64.RawURLEncoding.EncodeToString(sig))

	return nil
}

Python

To authenticate to Media CDN, set up Application Default Credentials. For more information, see Set up authentication for a local development environment. 

import base64
import datetime

import cryptography.hazmat.primitives.asymmetric.ed25519 as ed25519


from six.moves import urllib

def sign_url(
    url: str, key_name: str, base64_key: str, expiration_time: datetime.datetime
) -> str:
    """Gets the Signed URL string for the specified URL and configuration.

    Args:
        url: URL to sign as a string.
        key_name: name of the signing key as a string.
        base64_key: signing key as a base64 encoded byte string.
        expiration_time: expiration time as a UTC datetime object.

    Returns:
        Returns the Signed URL appended with the query parameters based on the
        specified configuration.
    """
    stripped_url =