The Problem
You have a video on a server. You want users to watch it. But you do not want them to download it. Or share direct links. Or scrape it with bots.
If you just put the file at cdn.example.com/video.mp4 anyone can copy that link. Share it anywhere. Download it forever. You have zero control once the link is out.
You need a way to say: "This person can watch this video. Right now. But not later. And nobody else can use their link."
Step 1: Signed URLs
A signed URL is a normal link with a temporary password baked into it.
The server has a private key. A secret file only the server knows. When a user requests a video the server does this:
Takes the video file path.
Picks an expiry time. Maybe 5 minutes from now.
Feeds the path and the expiry time and the private key into a signing algorithm. This produces a unique string called a signature.
Attaches all three to the URL.
The result looks like this:
cdn.example.com/video.mp4?Expires=1775506672&Key-Pair-Id=APKAI...&Signature=B029ItfCy...
Expires is a Unix timestamp. A number that represents a specific second in time.
Key-Pair-Id tells the server which key was used.
Signature is the proof that this URL is real and untouched.
When someone requests this URL the CDN checks: is the expiry time still in the future? Does the signature match? If anything is wrong or expired it rejects the request. Done.
If you change even one character in the URL the signature breaks. You cannot extend the expiry. You cannot swap the file path. The math will not match.
Step 2: Chunked Streaming (HLS)
Platforms do not serve one big video file. They use a protocol called HLS (HTTP Live Streaming).
HLS works like this:
The platform chops the video into small pieces called chunks. Each chunk is 2 to 10 seconds long. These are .ts files (Transport Stream).
The platform creates a playlist file (.m3u8). This is a text file that lists every chunk in order. Like a table of contents.
The video player fetches the playlist first. Then fetches chunks one by one. Plays chunk 1. Fetches chunk 2. Plays it. And so on.
The user never holds the full video at any point. Just tiny pieces arriving in real time.
Step 3: Combine Both
This is where it gets powerful. Every chunk gets its own signed URL with its own expiry.
The playlist itself is also a signed URL. So the full picture:
Playlist URL is signed. Expires in minutes.
Each chunk URL inside the playlist is signed. Expires in seconds.
Each user gets a different set of URLs. Generated fresh for their session.
Even if you open DevTools and grab a chunk URL you get one 5-second piece of the video. And the URLs for the other chunks are probably already dead.
The Full Flow in Order
You open Instagram and scroll to a video.
The app sends a request: "I want video 12345."
Instagram checks your login session. Confirms you are a real user.
The server generates a signed playlist URL. Just for you. Expires soon.
The app fetches the playlist.
The playlist contains signed URLs for each chunk.
The app fetches chunk 1. Plays it.
The app fetches chunk 2. Plays it.
This continues until the video ends.
If you try to reuse any of these URLs later they are expired. Dead.
What Sits Behind All of This: CDNs
The video files do not sit on one server. They sit on a CDN (Content Delivery Network). A CDN is a network of servers spread around the world. When you watch a video you are fetching chunks from the server closest to you.
The CDN is the gatekeeper. It checks every signed URL before serving the file. You never talk directly to the real storage. The CDN is the bouncer at the door.
Amazon CloudFront is one popular CDN that supports signed URLs out of the box. Many platforms use it. Instagram runs their own custom CDN but the concept is identical.
Can Someone Still Download the Video?
Yes. Tools like yt-dlp can automate the process. They fetch the playlist and all chunks fast enough before they expire. Then stitch the chunks back together.
The goal was never perfect security. The goal is practical obscurity. Make it annoying enough that 99% of people will not bother. The casual user cannot right-click and save. The DevTools link dies in minutes. Only someone with technical knowledge and dedicated tools can get through.
That is the tradeoff every platform accepts.
