Connect your website, server or app securely

How it fits together

Two secrets do the work: your embed key, which only your server knows, and the list of verified domains, which you prove with DNS.

1Secure your account and the embed key

Your panel login controls everything. The embed key lets anyone who has it sign links to your videos.

Panel account

• Use a long, unique password for the panel. Don't reuse it anywhere else.
• Give the login only to people who manage videos and settings. Your developers need the embed key, not the password.
• Sign out on shared or public computers.

Embed key

Find it under Settings → Embed key. Treat it like a database password:

2Lock the player to your domains

With signed embed links off and no verified domain, the player can be embedded on any site. When one domain is verified, it plays only on verified domains.

Add and verify each domain

1. Open Settings → Websites and add the exact host your pages are on.

   You enter	Player allowed on
   example.com	example.com only. Not www.example.com.
   www.example.com	www.example.com only
   *.example.com	example.com and every subdomain (www., app., learn., …)
   localhost	Your own computer while developing. Counts as verified with no DNS record.

   Enter just the host: no https://, no path, no port.

2. At your DNS provider, add the TXT record the panel shows:

   Domain you added	Type	Name	Value
   example.com	TXT	_streamingdog.example.com	streamingdog-verify=…
   www.example.com	TXT	_streamingdog.www.example.com	streamingdog-verify=…
   *.example.com	TXT	_streamingdog.example.com	streamingdog-verify=…

   Copy the value from the panel; it is different for every domain. Many DNS panels (GoDaddy, Namecheap, cPanel, Cloudflare) add your domain to the name for you. There, type only _streamingdog (or _streamingdog.www).

3. Check that the record is visible, then press Verify:
   TerminalCopy

   nslookup -type=TXT _streamingdog.example.com
   # or
   dig +short TXT _streamingdog.example.com

   New records can take a few minutes to show up. If the panel says the record isn't there yet, wait and press Verify again. A verification stays once it is made, so you can delete the TXT record afterwards.

What the lock does

• Browsers refuse to show the player inside any page that isn't on a verified domain. This covers every frame up the chain, so a verified page framed by another site doesn't play either.
• The panel refuses playback when the page's address isn't on a verified domain: “This video can only be played on approved websites.”
• From a browser, the Stream API (step 4) answers only pages on your verified domains.
• With Only browser players (step 5), the video servers serve files only to players on your verified domains.

3Sign links on your server

This is how you decide who may watch. Your server checks the viewer first, then signs a link that expires. A copied link stops working at that time.

1. Put the embed key in an environment variable on your server (step 1).
2. Keep Settings → Playback security → Require signed embed links on (the default for new accounts). The player loads only with a valid token and expires.
3. In your page code, after your own login or payment check, build the player link with the code below.

The token

uid is your own id for the viewer. Use a user id, never a password or session token. It counts as the viewer for stream limits and fills {uid} in the watermark. wm replaces the watermark text for that link, for example the buyer's name or email. Both are trusted only inside a signed link: if someone edits them, the token no longer matches.

import { createHash } from "node:crypto";

const APP_URL = "https://streamingdog.net";
const EMBED_KEY = process.env.STREAMINGDOG_EMBED_KEY; // Settings → Embed key. Never in browser code.

const sha256 = (s) => createHash("sha256").update(s, "utf8").digest("hex");
const field = (v) => `${Buffer.byteLength(v, "utf8")}:${v}`; // UTF-8 byte length + ":" + value

export function signedEmbedUrl(videoId, { ttl = 3600, uid = "", wm = "" } = {}) {
  const expires = Math.floor(Date.now() / 1000) + ttl; // seconds, not milliseconds
  let data = EMBED_KEY + videoId + expires;
  if (uid || wm) data += "|" + field(uid) + "|" + field(wm); // v2
  let url = `${APP_URL}/embed/${videoId}?token=${sha256(data)}&expires=${expires}`;
  if (uid) url += `&uid=${encodeURIComponent(uid)}`;
  if (wm) url += `&wm=${encodeURIComponent(wm)}`;
  return url;
}

// Example (Express): sign only after YOUR check that this viewer may watch.
app.get("/lessons/:id", requireLogin, async (req, res) => {
  const lesson = await db.lessons.find(req.params.id);
  if (!(await canWatch(req.user, lesson))) return res.status(403).send("Not included in your plan");
  const src = signedEmbedUrl(lesson.videoId, { uid: String(req.user.id), wm: req.user.email });
  res.render("lesson", { src }); // <iframe src="{{src}}" …></iframe>
});

<?php
const APP_URL = 'https://streamingdog.net';
define('EMBED_KEY', getenv('STREAMINGDOG_EMBED_KEY')); // Settings → Embed key. Never in browser code.

function sd_field(string $v): string {
    return strlen($v) . ':' . $v; // strlen counts UTF-8 bytes
}

function sd_embed_url(string $videoId, int $ttl = 3600, string $uid = '', string $wm = ''): string {
    $expires = time() + $ttl;
    $data = EMBED_KEY . $videoId . $expires;
    if ($uid !== '' || $wm !== '') {
        $data .= '|' . sd_field($uid) . '|' . sd_field($wm); // v2
    }
    $url = APP_URL . '/embed/' . $videoId . '?token=' . hash('sha256', $data) . '&expires=' . $expires;
    if ($uid !== '') $url .= '&uid=' . rawurlencode($uid);
    if ($wm !== '') $url .= '&wm=' . rawurlencode($wm);
    return $url;
}

// After your own login / purchase check:
if (!user_can_watch($user, $lesson)) { http_response_code(403); exit; }
$src = sd_embed_url($lesson['video_id'], 3600, (string) $user['id'], $user['email']);
echo '<iframe src="' . htmlspecialchars($src) . '" allow="autoplay; fullscreen; picture-in-picture; encrypted-media" allowfullscreen></iframe>';

import hashlib, os, time
from urllib.parse import quote

APP_URL = "https://streamingdog.net"
EMBED_KEY = os.environ["STREAMINGDOG_EMBED_KEY"]  # Settings → Embed key. Never in browser code.

def field(v: str) -> str:
    return f"{len(v.encode('utf-8'))}:{v}"  # UTF-8 byte length

def embed_url(video_id: str, ttl: int = 3600, uid: str = "", wm: str = "") -> str:
    expires = int(time.time()) + ttl
    data = f"{EMBED_KEY}{video_id}{expires}"
    if uid or wm:
        data += f"|{field(uid)}|{field(wm)}"  # v2
    token = hashlib.sha256(data.encode("utf-8")).hexdigest()
    url = f"{APP_URL}/embed/{video_id}?token={token}&expires={expires}"
    if uid:
        url += "&uid=" + quote(uid, safe="")
    if wm:
        url += "&wm=" + quote(wm, safe="")
    return url

# After your own login / purchase check:
# src = embed_url(lesson.video_id, uid=str(user.id), wm=user.email)

Put the signed link in your page

<div style="position:relative;padding-top:56.25%">
  <iframe src="SIGNED_LINK_FROM_YOUR_SERVER"
    style="position:absolute;inset:0;width:100%;height:100%;border:0"
    allow="autoplay; fullscreen; picture-in-picture; encrypted-media"
    allowfullscreen loading="lazy"></iframe>
</div>

• Make the link when the page is requested, not once at build time. A page cached for everyone (CDN, page cache) gives every visitor the same link: exclude those pages from caching, or keep the cache shorter than the link lifetime.
• A viewer who has started watching can keep watching for the Playback link lifetime (step 5), even after expires has passed. expires only limits when the player can be opened.
• Never sign links in browser JavaScript. If the key is in the browser, anyone can sign links to all your videos.

4Your own player or app (Stream API)

For hls.js, Video.js, Shaka, or a mobile or TV app. You get fresh signed video links after the same checks as our player.

GET https://streamingdog.net/api/v1/stream/{videoId}?token={token}&expires={expires}[&uid=…&wm=…&ip=…]

• token and expires are always required. Sign them exactly like an embed link (step 3). The Stream API works even when signed embeds are off.
• From a browser on one of your verified domains: the links are bound to the viewer's own address. Other sites get a 403.
• From your server: add ip= with the viewer's IP address, so IP locks and stream limits apply to the viewer and not to your server.
• The same rules as the embed apply: domain lock, stream limit, IP lock, watermark and account status. The answer is never cached, so ask again when expiresAt is near.
• With Only our embed player selected (step 5), the Stream API answers 403.

// sha256() and EMBED_KEY as in step 3.
const expires = Math.floor(Date.now() / 1000) + 3600;
const token = sha256(EMBED_KEY + videoId + expires);
// The viewer's real IP. Behind a CDN or load balancer, read it from the header YOUR proxy sets
// (e.g. CF-Connecting-IP, or Express with "trust proxy"), never from a header the client could send.
const viewerIp = req.ip;
const r = await fetch(
  `${APP_URL}/api/v1/stream/${videoId}?token=${token}&expires=${expires}&ip=${encodeURIComponent(viewerIp)}`,
);
if (!r.ok) throw new Error(`Stream API ${r.status}: ${await r.text()}`);
const stream = await r.json(); // hand stream.hls (or the whole object) to your app or page

<!-- TOKEN and EXPIRES come from your server (step 3). Never the embed key. -->
<video id="player" controls playsinline crossorigin="anonymous"></video>
<script src="https://cdn.jsdelivr.net/npm/hls.js@1"></script>
<script type="module">
  const API = "https://streamingdog.net";
  const res = await fetch(`${API}/api/v1/stream/VIDEO_ID?token=${TOKEN}&expires=${EXPIRES}`);
  if (!res.ok) throw new Error(`Stream API: ${res.status}`);
  const s = await res.json();
  const video = document.getElementById("player");
  if (Hls.isSupported()) {
    const hls = new Hls();
    hls.loadSource(s.hls);
    hls.attachMedia(video);
  } else if (!s.playerOnly) {
    video.src = s.hls; // Safari's built-in HLS
  }
  // Keeps the viewer's session open (stream limits, live viewers).
  if (s.sessionId) {
    setInterval(() => fetch(`${API}/api/playback-sessions/${s.sessionId}/ping`, { method: "POST", mode: "no-cors" }), 30_000);
  }
</script>

{
  "videoId": "abcde1234567",
  "title": "My video",
  "durationSec": 754,
  "expiresAt": "2026-10-24T18:00:00.000Z",  // the links stop working then
  "hls": "https://…/master.m3u8",           // every quality, audio track and subtitle
  "poster": "https://…/poster.jpg",
  "qualities": [ … ],                       // one playlist per quality
  "audio": [ … ],                           // audio-only playlists, one per track
  "subtitles": [{ "id": "…", "label": "English", "language": "en", "default": true, "vtt": "https://…" }],
  "sessionId": "…",                         // ping it every 30 s while the page is open
  "watermark": null,                        // text to draw over the video when the watermark is on
  "playerOnly": false                       // true: only browser players on your domains get the files
}

5Protect the video files

Settings → Download protection and Settings → Playback security. These make saved or shared file links useless.

Who can play your video links

A stricter choice applies at once, also to links you handed out before: their master and quality playlists are refused outside the allowed players. Audio-only links and video files a player has already loaded keep working until they expire. With Only browser players, your own player must use hls.js or Media Source with crossorigin="anonymous". Safari's built-in HLS is refused (hls.js plays on current Safari).

The other switches

Which level you need

Start from the row that matches your videos. Each level includes the one before it.

6Test your setup

Each test should be refused. If one plays, the setting it checks isn't on yet.

When something is refused

The player shows the message. The Stream API returns it with this status.

With Only browser players on, a video that starts but stays black on Safari means your own player uses Safari's built-in HLS: switch to hls.js. Still stuck? Open a support ticket. Never paste your embed key into a ticket.

Checklist

Tick items as you go. Your ticks are saved only in this browser.

• The panel password is long, unique, and known only to the people who need it.
• The embed key is in an environment variable on my server. It isn't in Git, browser code or an app.
• Every host my pages use is verified (example.com and www.example.com, or *.example.com).
• My site doesn't send Referrer-Policy: no-referrer.
• Require signed embed links is on, and my server signs links only after its own login or payment check.
• Pages with signed links aren't cached for everyone, or not for longer than the link lifetime.
• Links carry a uid (and a wm for paid content).
• Who can play your video links is set for my level.
• Encryption, IP lock, stream limit, watermark and link lifetime are set for my level.
• MP4 fallback is off, unless I really need it.
• Every test in step 6 is refused.
• I know how to rotate the embed key, and that I must update my server first.