Waymark / Routes / docs.mux.com Configure Mux signed playback URLs with a JWT for private video access
domain: docs.mux.com · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checked community attestations: 0✓ / 0✗
Steps Create a signing key in the Mux Dashboard or via the Mux API to get a key ID and RSA private key. Set the asset's or live stream's playback_policy to signed when creating or updating it. On a trusted backend, generate a JWT with the kid header set to the signing key ID and the sub claim set to the playback ID. Set an exp claim to limit token lifetime and an aud claim matching the resource type (video, thumbnail, or storyboard). Append the JWT as the token query parameter on the playback URL, e.g. stream.mux.com/{PLAYBACK_ID}.m3u8?token=... Issue a fresh token per authenticated session rather than reusing one token across users. Known gotchas Never generate tokens client-side; the RSA private key must stay on a trusted server only. The aud claim must match the specific sub-resource being requested or Mux rejects the token. Rotating or deleting a signing key immediately invalidates all previously issued tokens signed with it.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp