A signed URL grants access to one object for a short time without a login. It protects paid video and downloads only if your server issues it after checking entitlement, keeps expiry short, and never lets the link be used to reach anything else. A signed link is a capability: whoever holds it can use it.
What a signed URL actually proves
It proves that someone with the signing key approved this exact request. It does not prove who is using it. If a paying customer shares the link, the recipient gets in until it expires. So design around that fact.
Issue links from your server, after a check
- The player asks your API to watch or download an item.
- Your server checks that this account owns or subscribes to it.
- Only then does it create a signed link for that object.
Never put the signing key in the app or web page. Never create links for every item in advance.
Expiry and scope
- Short expiry for streams and downloads. Minutes, not days, unless a large file needs longer to finish. Pick a value from real download times.
- Bind the signature to a single object path, and where the system supports it, to specific conditions such as method.
- Do not sign broad prefixes or wildcards unless you accept that all objects under them are reachable.
- Rotate the signing key on a schedule and when you suspect exposure. Support two keys during rotation.
Streaming specifics
Video is fetched as many small segments, so a single link on the playlist is not enough. Either sign each segment request or use a short lived token carried by the player and checked at the edge. Keep playlist tokens short and refresh them while the viewer is active.
Reduce sharing and abuse
- Limit concurrent streams per account.
- Log link issue and use with account and network, and alert on one account fetching from many places.
- Consider watermarking for high value content, so leaks can be traced.
- Do not claim that links stop copying. A viewer can always record what they can see.
Common mistakes
- Links that never expire, or expire next year.
- The same link reused in emails and notifications.
- Logging full signed URLs in analytics, which turns logs into a key to your content.
- Referer based checks treated as security, since the header is easy to fake.
Quick check
Should a signed URL be tied to a user account?
Where your system allows it, yes, or at least issue it only after an account check. Logging who requested it also helps with abuse review.
Do signed URLs stop piracy?
No. They control who may fetch the file for a limited time. They do not stop recording or redistribution.
Safeguard can scan the services that issue these links for dependency issues. Try the free scan at https://gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
