Generate Playback Token — Ansdev Cloud Docs

Generates a short-lived JWT bound to a single videoId. The token is the only credential the Player SDK (or your HLS player) needs to fetch the manifest and stream the video — no API key required at playback time.

Tokens expire in 5 minutes and cannot be refreshed or rebound. Generate a fresh token per playback session.

Endpoint

POST /v1/video/{videoId}/playback-token

Authentication

Method	Required scope
API Key	`video:read`

Parameters

Name	In	Type	Required	Description
`videoId`	path	string	yes	The video to play

No request body.

Response

200 OK

{
  "success": true,
  "data": {
    "token": "pt_eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "expiresIn": 300,
    "playerUrl": "https://sdk.ansdev.cloud/embed?token=pt_eyJhbG..."
  }
}

Field	Type	Notes
`token`	string	JWT, prefixed `pt_`, 5-minute TTL
`expiresIn`	integer	Seconds until expiry
`playerUrl`	string	Pre-built embed URL with the token baked in

Errors

Status	Code	When
401	`INVALID_API_KEY`	Key revoked or unknown
403	`INSUFFICIENT_SCOPE`	Key lacks `video:read`
404	`VIDEO_NOT_FOUND`	ID doesn't exist, or isn't owned by this key
429	`RATE_LIMIT_EXCEEDED`	Daily quota hit — see Rate Limits

⚠️ Server-side only

This endpoint requires your API key. Never call it from client-side JavaScript — that exposes the key to anyone with the browser DevTools open. Generate the token on your server, then send only the short-lived token to the browser.

💡 Pass tokens straight to the SDK

The Player SDK accepts a playback-token attribute and handles the manifest fetch and decryption automatically. See Quickstart.

Token security

Tokens are HS256-signed JWTs with a 5-minute expiry.
Each token is bound to one specific videoId — replaying it against a different video returns PLAYBACK_TOKEN_INVALID.
Tokens cannot be revoked individually. Revoking the parent API key prevents new tokens, but existing tokens remain valid until they expire (~5 minutes max exposure).

Examples

cURL

curl -X POST \
  -H "x-ansdev-key: ak_live_8f3a9b2c1d4e5f6a7b8c9d0e1f2a3b4c" \
  https://api.ansdev.cloud/v1/video/vid_abc123def456/playback-token

Node.js (Express)

import express from 'express';

const app = express();

// Your frontend calls THIS endpoint, not the Ansdev API directly.
app.get('/api/play/:videoId', async (req, res) => {
  const upstream = await fetch(
    `https://api.ansdev.cloud/v1/video/${req.params.videoId}/playback-token`,
    {
      method: 'POST',
      headers: { 'x-ansdev-key': process.env.ANSDEV_API_KEY },
    },
  );

  if (!upstream.ok) {
    return res.status(upstream.status).json(await upstream.json());
  }

  const { data } = await upstream.json();
  // Return only the token — keep your API key on the server
  res.json({ token: data.token, expiresIn: data.expiresIn });
});

Browser (using the token)

<script src="https://sdk.ansdev.cloud/v1/player.js"></script>

<ansdev-player
  video-id="vid_abc123def456"
  playback-token="pt_eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
></ansdev-player>