---
title: CDN URL Tokenization
url: https://docs.kaltura.com/docs/rich-media-cms-apis/content-management/content-delivery-cdn-url-tokenization
---

## CDN URL Tokenization


When a delivery profile has a URL tokenizer configured, signed tokens are automatically appended to all URLs in the manifest. This prevents unauthorized hotlinking.

**Supported CDN tokenizers:**

| CDN | Mechanism |
|-----|-----------|
| **Akamai** | `__gda__` parameter with HMAC-MD5 token |
| **AWS CloudFront** | RSA-SHA1 signed URLs with `Policy`, `Signature`, `Key-Pair-Id` parameters. Supports ACL-based policies, IP restriction, and expiry |
| **Level3 / CenturyLink** | Level3 URL authentication |
| **Limelight** | Limelight CDN token |
| **Kaltura CDN** | Internal `kt` token using SHA1(secret + URL) |
| **KS-based** | KS token embedded in URL |

Tokenization is forced automatically when entitlement is enabled or access control rules exist on the entry.

**Kaltura URL Token (`kt`):** playManifest supports pre-signed URLs for embedding in emails or offline use:
- `expiry` = Unix timestamp when the URL expires  
- `kt` = SHA1(url_token_secret + URL with `{kt}` placeholder)  
- When present, KS validation is bypassed — the URL itself is the authorization