All Products
Search

This Product

    ApsaraVideo VOD:Obtain a playback credential

    Document Center

    ApsaraVideo VOD:Obtain a playback credential

    Last Updated:Nov 04, 2025

    Playback credentials are time-sensitive, have one-to-one correspondence with videos, and cannot be mixed or reused. When a credential expires or is incorrect, the corresponding playback URL cannot be obtained, which makes them suitable for scenarios with higher security requirements for audio and video playback.

    Usage notes

    • ApsaraVideo Player supports playing videos using playback credentials, but third-party players do not support this method.

    • By default, a playback credential is valid for 100 seconds and up to 3,000 seconds. You can use the playback credential to obtain the playback URL for only the specified video. The playback credential cannot be reused or used to obtain the playback URL of a video other than the specified one. If the credential expires, you cannot obtain the playback URL. You need to handle the refresh issue after the playback credential expires.

    • The validity period of a playback credential is different from the validity period of a playback URL (when URL authentication is enabled). The latter can be customized without an upper limit.

    • If you specify Alibaba Cloud proprietary cryptography, you can play the file only using ApsaraVideo Player SDK.

    Overall process

    The following explains the overall process of obtaining a playback credential and playing a video using a CDN-accelerated domain name as an example.

    image

    1. The client passes the VideoId and sends a request to the server to obtain a playback credential.

    2. The server can call GetVideoPlayAuth - Obtain audio and video playback credential through Server SDK to obtain the playback credential.

    3. The VOD service returns the playback credential to the server.

    4. The server returns the playback credential to the client.

    5. The client player requests the playback URL from the VOD service based on the returned playback credential.

    6. The VOD service directly returns the playback URL to the client.

    7. The client requests playback resources based on the returned playback URL.

    8. When the CDN node does not have the resource or the resource has expired, it needs to fetch from the origin OSS Bucket.

    9. The OSS Bucket returns resources to the CDN node, and the CDN node caches the resources.

    10. The CDN node returns the media resources.

    What to do next

    Player SDKs for Web, Android, iOS, Flutter, and Harmony are provided. These SDKs can use a playback credential to automatically obtain the playback URL to play the video. For more information, see the following topics: