Control who can watch and manage

Dashboard authorization and playback authorization are separate. Someone can watch through a valid link without an account that lets them manage the library.

Accounts, roles, and environments

The dashboard uses HttpOnly sessions with email and password. Organizations have members and roles; permissions are also enforced on the server. Select the correct environment before creating tokens, sharing content, or querying data.

Administrators manage members, invitations, tokens, and webhook destinations. A reader can view permitted resources, while write operations require their corresponding permission.

Account protection

My account lets you configure TOTP MFA and ten single-use recovery codes. Email recovery requires SMTP and does not remove MFA; resetting a password revokes previous sessions and links. Key configuration and email deliverability are the operator’s responsibility.

Integration tokens

The compatible /video/v1, /system/v1, and /data/v1 routes use Basic authentication with the token ID and secret. The SDK configures it for you. The native /v1 API retains Bearer authentication.

Use tokens with the minimum required permissions, keep them in your backend, and rotate them if you suspect exposure. Documentation examples contain no real credentials.

Public and signed playback

• Public: anyone who receives the link can play the content while the playback ID remains active.
• Signed: your backend generates temporary authorization with a signing key. Expiration and claims define the scope of access.

Playlists, segments, thumbnails, and other protected resources also require authorization. Do not expose the private key in the browser to sign URLs.

Domain and user-agent restrictions are configured per environment and through signed claims. They do not provide DRM or prevent retrieval of previously downloaded content.

Signed instant clips restrict segments and associated resources. A public clip uses parameters that can be removed; do not use it as an authorization boundary.

Sharing from the dashboard

Opening the sharing dialog does not make an asset public. Creating a permanent link is an explicit action requiring write permissions. Temporary access expires and must be renewed.

Revocation and downloaded files

Revoking a link prevents new authorized requests through that access. It cannot remove a file someone has saved to their device.

Your own installation

Serve the dashboard and media over HTTPS. Keep secrets and configuration out of Git, protect credential files, and maintain verified backups. Signed storage access depends on the public domain and proxy preserving the expected paths and host.