All Products
Search

This Product

    ApsaraVideo VOD:Retrieve playback credential

    Document Center

    ApsaraVideo VOD:Retrieve playback credential

    Last Updated:Dec 09, 2025

    A playback credential is a time-limited token that is specific to a single video, making it non-transferable and non-reusable. If a credential expires or is invalid, the corresponding playback URL cannot be retrieved. This method is ideal for scenarios that require a higher level of security for video playback.

    Usage notes

    • ApsaraVideo Player supports playback using a credential. Third-party players do not support this method.

    • By default, a playback credential is valid for 100 seconds (configurable up to 3000 seconds). It can only be used to retrieve the playback URL for a specific video and cannot be reused. If a credential expires, a playback URL cannot be obtained. Your application is responsible for handling credential expiration and refreshing it when needed.

    • The expiration time of a playback credential is not the same as the expiration time of the playback URL (if you have enabled URL signing). The URL's expiration time can be customized and has no upper limit.

    • If you have enabled Alibaba Cloud proprietary cryptography, the video can only be played using the ApsaraVideo Player.

    Workflow

    The following diagram illustrates the workflow for retrieving a playback credential and playing the video, using a CDN-accelerated domain as an example.

    image

    1. The client sends the VideoId to your application server to request a playback credential.

    2. The server calls GetVideoPlayAuth through the Server SDK to obtain the playback credential.

    3. ApsaraVideo VOD returns the playback credential to your server.

    4. The server returns the playback credential to the client.

    5. The client player uses the credential to request the playback URL from ApsaraVideo VOD.

    6. ApsaraVideo VOD returns the playback URL to the client.

    7. The client requests media resource based on the returned playback URL.

    8. If the resource is not cached on the CDN POP or the cache has expired, the CDN performs an origin-pull from the OSS bucket.

    9. The OSS bucket serves the resource to the CDN POP, which then caches it.

    10. The CDN POP returns the media resource to the client.

    What to do next

    ApsaraVideo Player SDK is available for Web, Android, iOS, and Flutter, all of which support playback using a credential. Refer to the corresponding documentation: