Playback URL Tokens for NextGen Live

Overview

NextGen Live playback involves two different tokens:

livePlaybackToken — a JWT you pass when requesting playback URLs. It tells Brightcove which manifest, features, and options to return (DVR, SSAI, timeshift window, and so on). It does not, by itself, restrict who can play the stream.
Signed playback URLs — the manifest URLs returned by the Playback API are signed by Brightcove. They cannot be forged: you cannot guess a job ID and construct a working stream URL without going through the API.

This replaces legacy Akamai EdgeAuth CDN signed URLs. It is not a drop-in substitute for playback restrictions or other viewer-level access controls.

livePlaybackToken

livePlaybackToken is a JWT from the Live API. Pass it to the Brightcove Player or the Playback API to fetch playback URLs for a channel.

Studio Embed on Web includes a token automatically. For custom integrations, create one via the Live API. See Understanding Playback Tokens in the Live module guide.

When do you need one?

You need a livePlaybackToken to retrieve playback URLs with non-default configuration. Without it, the Playback API returns basic live delivery only.

livePlaybackToken and playback URL options
Feature	Token required to fetch URLs	If omitted
Basic live playback	No	Default live manifest URL is returned
DVR	Yes	No DVR manifest or seek window
SSAI	Yes	No SSAI manifest endpoints
DRM	Yes	DRM packaging may not apply
BYO CDN	Yes	Default CDN URLs are returned
Timeshift	Yes	No catch-up window — see Timeshift

Signed playback URLs

When you request playback with a livePlaybackToken, the Playback API returns manifest URLs (HLS .m3u8 or DASH .mpd) in the sources array. Each URL is signed by Brightcove.

Players use these URLs directly. You do not create or manage the signatures; Brightcove issues signed URLs when the Playback API responds.

Because the URLs are signed, they cannot be constructed from a job ID alone. A working playback URL must come from the Playback API (or a player embed that calls it on your behalf).

Playback protection (separate concern)

Restricting who can play a stream is separate from fetching playback URLs:

Playback restrictions — domain, geo, and IP allowlists
License key protection — viewer-specific JWT authorization
require_playback_auth on the playback-token request — enforces license-key protection when enabled on the channel

None of these are implied by issuing a livePlaybackToken alone.

Create a livePlaybackToken

POST https://api.live.brightcove.com/v2/accounts/{account_id}/playback/{job_id}/token

{
  "dvr": true,
  "ssai": true,
  "low_latency": false,
  "manifest_format": "hls",
  "require_playback_auth": false
}

Response:

{
  "token": "eyJhbGciOiJSUzI1NiIs..."
}

Token request fields
Field	Description
`dvr`	Request DVR-enabled playback URLs
`ssai`	Request SSAI manifest endpoints
`ad_config_id`	SSAI ad configuration to use
`byocdn_id`	BYO CDN configuration
`cenc`	DRM CENC packaging
`require_playback_auth`	Include playback-authorization requirements when license key protection is enabled on the channel
`start_time`, `end_time`	Timeshift playback window (ISO 8601 or epoch), not token expiration. See Timeshift.

Fetch playback URLs

Brightcove Player

Pass the token in the embed URL. The player calls the Playback API and uses the signed manifest URLs in the response.

https://players.brightcove.net/ACCOUNT_ID/PLAYER_ID/index.html?videoId=JOB_ID&livePlaybackToken=TOKEN_VALUE

Playback API

GET https://edge.api.brightcove.com/playback/v1/accounts/{account_id}/videos/{job_id}?livePlaybackToken={token}

The response sources[].src values are the signed manifest URLs. Match token flags to features enabled on the channel.