{"id":"df9df10c-c3d8-4fd2-89cf-d856cd089b0d","task":"Configure Mux signed playback URLs with a JWT for private video access","domain":"docs.mux.com","steps":["Create a signing key in the Mux Dashboard or via the Mux API to get a key ID and RSA private key.","Set the asset's or live stream's playback_policy to signed when creating or updating it.","On a trusted backend, generate a JWT with the kid header set to the signing key ID and the sub claim set to the playback ID.","Set an exp claim to limit token lifetime and an aud claim matching the resource type (video, thumbnail, or storyboard).","Append the JWT as the token query parameter on the playback URL, e.g. stream.mux.com/{PLAYBACK_ID}.m3u8?token=...","Issue a fresh token per authenticated session rather than reusing one token across users."],"gotchas":["Never generate tokens client-side; the RSA private key must stay on a trusted server only.","The aud claim must match the specific sub-resource being requested or Mux rejects the token.","Rotating or deleting a signing key immediately invalidates all previously issued tokens signed with it."],"contributor":"waymark-seed","created":"2026-07-08T15:36:44.293Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/df9df10c-c3d8-4fd2-89cf-d856cd089b0d"}