ProjectsVideo infrastructure
Private video delivery from R2
Pre-encoded HLS served from R2 through a Worker, with signed links that expire
Example design
- 01Manifest requestThe player asks for the HLS manifest with a signed token in the URL.
- 02Check tokenThe Worker checks the HMAC signature, the expiry, and that the token covers this title.
- 03Read manifestIt reads the manifest from R2 and adds the same token to every segment URL in it.
- 04Segment requestThe player fetches segments, and the Worker checks the token on each one.
- 05Cache lookupSegments are cached under a key without the token, so every viewer shares one cached copy.
- 06Read on a missOn a miss the Worker reads the segment from R2, passing through any byte range the player asked for.
- ifSomeone shares a linkThe token expires, so the shared link stops working. This controls access but it is not DRM: anyone who can play the video can record their screen.
The problem
Some libraries are already encoded and only need delivering: training archives, course videos, a back catalogue from an old platform. Paying a video platform to store and re-encode them is unnecessary, and a public bucket lets anyone with a link watch. Serving them from R2 through a Worker gives private links that expire, edge caching, and no egress fees.
What it uses
- R2
- Manifests and segments, with no egress fees
- Workers
- Token checks, manifest rewriting and range reads
- Cache API
- One edge copy of each segment for all viewers
The decisions, and why
- TokenHMAC with a short expiry
- Your app signs a token when it shows the player. The Worker can check it without a database call.
- Cache keyWithout the token
- Each viewer's token is different. Leaving it out of the key lets them all share one cached segment.
- ManifestsRewritten for each viewer
- The manifest carries the viewer's token, so it is not shared. It is small, and most of the bytes are in the segments.
- Segment lengthChosen with cost in mind
- Every segment request runs the Worker, so longer segments mean fewer requests to pay for.
Limits to plan around
- This is access control, not DRM. Use Licence Gateway where content has to be protected from recording.
- Request volume grows with audience size and shrinks with segment length.
What you get
- Worker for tokens, manifests and segments
- Token signing for your app
- Cache configuration and a cost estimate
- Upload tooling for an existing library
- Tests for expiry and tampered tokens
Other projects
More video work on Cloudflare.
- Serverless video platformUploads, encoding, captions and signed playback with no servers to run
- Thumbnails and previews by URLHover previews, thumbnails and storyboards for a clip library, with no batch jobs
- FFmpeg encoding on Cloudflare ContainersYour own ladder and packaging, started by an upload, served from R2
- Sub-second live with WHIP and WHEPLive auctions, Q&A and watch-alongs where a few seconds of delay is too much
- Searchable video archiveFind the moment in hours of recordings by what was said
- Instant clips from a live streamViewers clip the moment they just saw and share it while the event is still on
DRM solutions
Three corporate use cases, each with a Widevine demo that runs in your browser and checks what your device supports.
Talk about your video project
Tell us what you are building, or what is not working in the platform you have.
Registered officeVI Data Services Ltd
128 City Road, London, EC1V 2NX, United Kingdom
128 City Road, London, EC1V 2NX, United Kingdom
Telephone
Company number
17420568
Registered in England and Wales