The Embed View Token Authentication allows you to secure your iframe to prevent unauthorized embedding of your videos.
Once enabled, every embed request to the iframe must include a valid token and expires pair. A 403 Forbidden on the iframe almost always means one of: the expires timestamp has already passed, the token was hashed with the wrong key/video ID/expiration combination, or the parameters are missing entirely. Generate tokens server-side — never expose your token security key in client-side code.
Signing procedure
To create a secure URL, you must add a token and expires query parameters to the URL that you want to access. The expires parameter is the UNIX timestamp in seconds marking until when the URL is accessible. Milliseconds and nanoseconds are not supported. After this passes, the URL will no longer be accessible.
The token parameter is a HEX value of the SHA256 hash based on the key, video ID and expiration time. To generate the token, you can use the following algorithm.
Copy the token security key from the Token authentication key card on your library’s Security page. The field is labelled API key, but it’s a different value from the library’s API key. CDN token authentication uses the same key.
An example secure URL will then look like:
Similarly, the MediaCage Enterprise DRM license service endpoint URL example looks like:
Sign URLs in your framework
Sign embed URLs on the server has working signing code for Next.js, Nuxt, and SvelteKit, each with a runnable example app. 
