Protect your content with signed URLs

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "resource": "/v2/playlists/Xw0oaD4q",
  "exp": 1893456000,
  "related_media_id": "RltV8MtT"
}

const jwt = require('jsonwebtoken');
const Time = new Date();

const API_SECRET = 'V1APISECRET';

/**
 * Generatea a URL with signature.
 * @param {string} path
 * @param {string} host 
 * @returns {string} signed URL
 */
function jwt_signed_url(path, host = 'https://cdn.jwplayer.com') {
    const token = jwt.sign(
        {
            exp: Math.ceil((Time.getTime() / 1000 + 3600) / 300) * 300,
            resource: path,
        },
        API_SECRET,
        {
            noTimestamp: true
        }
    );

    return `${host}${path}?token=${token}`;
}

const media_id = 'MEDIAID';
const path = `/v2/media/${media_id}`;
const url = jwt_signed_url(path);

console.log(url);

import math
import time
import urllib.parse

# Requires installing third party packages:
# $ pip install python-jose requests
from jose import jwt
import requests

API_SECRET = os.environ["JWPLATFORM_V1API_SECRET"]

def jwt_signed_url(path, host="https://cdn.jwplayer.com"):
    """
    Generate url with signature.
    Args:
      path (str): url path
      host (str): url host
    """
    
    # Link is valid for 1 hour but normalized to 6 minutes to promote better caching
    exp = math.ceil((time.time() + 3600) / 300) * 300
    
    params = {}
    params["resource"] = path
    params["exp"] = exp
    
    # Generate token
    # note that all parameters must be included here
    token = jwt.encode(params, API_SECRET, algorithm="HS256")
    url = "{host}{path}?token={token}".format(host=host, path=path, token=token)
    
    return url
  
media_id = "YOUR MEDIA ID"  # Replace
path = "/v2/media/{media_id}".format(media_id=media_id)
url = jwt_signed_url(path)

r = requests.get(url)
print(r.json())

md5(CONTENT_PATH:EXPIRATION_STAMP:ACCOUNT_SECRET)

const MD5 = require('crypto-js/md5');
const Time = new Date();

const API_SECRET = 'V1APISECRET';

/**
 * Returns a signed url, can be used for any "non-JWT" endpoint
 * @param {string} path
 * @param {int} expires 
 * @param {string} secret 
 * @param {string}host 
 * @returns {string} A signed url
 */
function signed_url(
    path,
    expires = 6000,
    secret = API_SECRET,
    host = 'https://cdn.jwplayer.com'
) {
    const base = `${path}:${expires}:${secret}`;
    const signature = MD5(base);
    return `${host}/${path}?exp=${expires}&sig=${signature}`;
}

/**
 * Return signed url for the single line embed javascript
 * @param {string} mediaid The media id (also referred to as video key)
 * @param {string} playerid The player id (also referred to as player key)
 * @returns 
 */
function get_response(mediaid, playerid) {
    const path = `players/${mediaid}-${playerid}.js`;
    const expires = Math.ceil((Time.getTime() / 1000 + 3600) / 300) * 300;
    return signed_url(path, expires);
}

console.log(get_response('MEDIAID', 'PLAYERID'));

import hashlib
import math
import time


API_SECRET = os.environ["JWPLATFORM_V1API_SECRET"]  # Replace

def signed_url(path, expires, secret=API_SECRET, host="https://cdn.jwplayer.com"):
    """
    returns a signed url, can be used for any "non-JWT" endpoint
    Args:
      path(str): the jw player route
      expires(int): the expiration time for the URL
      secret(str): JW account secret
      host:(str): url host
    """
    s = "{path}:{exp}:{secret}".format(path=path, exp=str(expires), secret=API_SECRET)
    signature = hashlib.md5(s.encode("utf-8")).hexdigest()
    signed_params=dict(exp=expires, sig=signature)
    return "{host}/{path}?{params}".format(
        host=host, path=path, params=urllib.parse.urlencode(signed_params)
    )

    
def get_signed_player(media_id, player_id):
    """
    Return signed url for the single line embed javascript.

    Args:
      media_id (str): the media id (also referred to as video key)
      player_id (str): the player id (also referred to as player key)
    """
    path = "players/{media_id}-{player_id}.js".format(
        media_id=media_id, player_id=player_id
    )

    # Link is valid for 1 hour but normalized to 5 minutes to promote better caching
    expires = math.ceil((time.time() + 3600) / 300) * 300

    # Generate signature
    return signed_url(path, expires)

media_id = "YOUR MEDIA ID"  # Replace
player_id = "YOUR PLAYER ID"  # Replace
signed_url = get_signed_player(media_id, player_id)
print(signed_url)
print(
    "<script type='text/javascript' src='{signed_url}'></script>".format(
        signed_url=signed_url
    )
)