The moment content costs money or carries rights, every URL becomes a policy question: who may fetch this, until when? Token authentication answers it at the edge, cryptographically, without asking your origin, and the design choices inside it decide both your security posture and your cache efficiency.
The core scheme
A signed URL carries an expiry timestamp and an HMAC computed over the path, expiry and a shared secret; edges validate the signature and clock before serving. Verification is microseconds of local crypto, no origin call, which is the entire point: authorization at cache speed. Variants bind tokens to client IP (rough, breaks on mobile NAT), to session identifiers, or to path prefixes so one token covers a stream’s many segments.
Design tensions worth respecting
Short expiries bound leak damage but punish long sessions, a two-hour movie needs tokens that outlive attention spans or a renewal mechanism inside the player. Cookie-carried tokens keep URLs clean and cacheable but require careful CDN config so the cookie neither busts caching nor leaks into keys; query-string tokens must be excluded from cache keys explicitly or every user fragments the cache into private shards, silently. That last misconfiguration is among the most common we find in media audits.
The architectural principle underneath deserves stating because it generalizes: this is authorization moved to the data plane. Your app decides once, at token mint time, and the edge enforces millions of times at line rate, with cryptography carrying the decision outward instead of requests carrying questions inward. The same pattern now runs far beyond media, API keys validated at edge, JWT claims checked before origin, personalization flags read from signed cookies, and it is the honest core of the edge-computing pitch: not moving your application outward, but moving your decisions outward. Teams that internalize the distinction design calmer systems.
Revocation, honestly
Pure signature schemes cannot revoke one token before expiry, the math has no memory. Practical layers: keep expiries short enough that revocation rarely matters, rotate signing keys (with overlap windows) to invalidate eras of tokens, or add an edge-side denylist checked per request, spending a little latency for real-time control. Choose per asset class; a live sports stream and a documentation PDF do not deserve the same ceremony.
In practice
Standardize one scheme estate-wide, exclude tokens from cache keys deliberately and verify with variant-count checks, load-test validation at your peak request rate, and rehearse key rotation before you need it hostile. Then audit quarterly for the classic leak: tokened URLs escaping into referrer logs, analytics and shared links, which no cryptography survives.
Media token design is a standing module in our streaming engagements: scheme, expiry map, rotation runbook, leak audit.