Configure Cloudflare Stream signed URL tokens with per-viewer accessRules (IP and country) and a downloadable flag for token-gated playback

Steps

1. Create a signing key via the Stream API or dashboard and keep the private key on your server only, never exposed to clients
2. On your backend, mint a signed Stream token for the video UID with an explicit exp claim, since calling the token endpoint with no body returns a token that defaults to a short (about one hour) expiry with no other restrictions
3. Add an accessRules array to scope the token to specific IPs, IP ranges, or countries; rules are evaluated in order and the first matching rule's allow/block action applies, so put the most specific rule first
4. Set downloadable to true only when you intend to expose the signed MP4 download link for that token - it has no effect unless requireSignedURLs is also enabled on the video
5. Enable requireSignedURLs on the video itself so unsigned playback requests are rejected
6. Serve the resulting token to the authenticated viewer and build the manifest URL as https://customer-code.cloudflarestream.com/{token}/manifest/video.m3u8