Waymark / Routes / developers.cloudflare.com Configure Cloudflare Stream signed URLs for private video playback
domain: developers.cloudflare.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checked community attestations: 0✓ / 0✗
Steps Mark the video as requiring signed URLs (requireSignedURLs: true) via the Stream API or dashboard. For low-volume use, call the video's /token endpoint to mint a token that expires in one hour. For high-volume use, create a Stream signing key (RSA key pair) and self-sign JWTs instead of calling the token endpoint per view. Include the signed token when requesting the playback manifest so Cloudflare's edge validates it before serving segments. Optionally combine with the Allowed Origins setting to restrict which domains can request the manifest. Known gotchas The /token endpoint is rate-limited, so high-traffic apps should self-sign JWTs with a stored signing key instead. Tokens generated via the endpoint default to a 1 hour expiry; self-signed JWTs let you set a custom exp. Allowed Origins enforcement relies on the request's Referer/Origin header, so it doesn't by itself block direct, headerless requests.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp