CDN URL Tokenization - Content Management
CDN URL Tokenization
When a delivery profile has a URL tokenizer configured, signed tokens are automatically appended to all URLs in the manifest. This prevents unauthorized hotlinking.
Supported CDN tokenizers:
| CDN | Mechanism |
|---|---|
| Akamai | __gda__ parameter with HMAC-MD5 token |
| AWS CloudFront | RSA-SHA1 signed URLs with Policy, Signature, Key-Pair-Id parameters. Supports ACL-based policies, IP restriction, and expiry |
| Level3 / CenturyLink | Level3 URL authentication |
| Limelight | Limelight CDN token |
| Kaltura CDN | Internal kt token using SHA1(secret + URL) |
| KS-based | KS token embedded in URL |
Tokenization is forced automatically when entitlement is enabled or access control rules exist on the entry.
Kaltura URL Token (kt): playManifest supports pre-signed URLs for embedding in emails or offline use:
expiry= Unix timestamp when the URL expireskt= SHA1(url_token_secret + URL with{kt}placeholder)- When present, KS validation is bypassed — the URL itself is the authorization