Security
Control who can play your videos, on which sites and from which countries, and how they're protected.
The Security page decides where your videos play, for whom, and how they're protected against copying. Every setting applies to the whole library.
Open it from the library sidebar: Libraries → your library → Security. It has three tabs: Overview, Access and Content protection.
Each setting is tagged with what happens when you change it:
| Tag | Meaning |
|---|---|
| Instant | Applies to the next playback. |
| Applies to new uploads | Videos you upload from now on get it; existing videos keep their current version. |
| Re-encode required | Every video is encoded again before the change reaches viewers. |
Overview
The Protection checklist shows what's set and what's missing, each with a link to the setting that changes it.
- Required: OTP authentication (always on), allowed domains and encryption.
- Optional, turn on if you need it: the user-based watermark, the static logo watermark and country blocking.
If Allowed domains not set shows, any website can embed your videos right now. Fix that first.
OTP authentication
Every playback needs a one-time password (OTP) that your server gets with the library's private key. OTP authentication can't be turned off; you choose its rules on the Access tab, and changes apply instantly.
| Setting | What it controls |
|---|---|
| OTP must be used within | How long an OTP stays valid before playback starts. If your server sends a shorter ttl_seconds, the shorter one wins. |
| Playback session after use | How long the viewer can keep watching once the OTP is used, such as the video length plus a margin. |
| Lock the OTP to | One video / widget: the OTP only unlocks what it was requested for. Viewer IP: the OTP only works from one IP address, which breaks on networks that switch IPs mid-session. |
| Single use | A second request with the same OTP is refused. |
How a playback is checked:
- Your server asks for an OTP with the private key.
- Your page puts the OTP in the player or widget iframe.
- OctaVideo checks the OTP, the domain and the country, then starts the session.
Ready-to-paste embeds skip some of these
Iframes made with Quick Embed share one OTP for a month, so the time window, the session length, the viewer IP lock and single use don't apply to them. They're always locked to one video or widget and only play on your allowed domains. Server OTPs from your own backend follow every setting here.
To request OTPs from your server, see Secure playback.
Allowed domains
Allowed domains lists the sites your videos may play on. It's the same list you see in API & embeds.
example.commatches that exact host.*.example.commatches any subdomain, such aslearn.example.com, but notexample.comitself. Add both if you need both.- With no domains set, any website can embed your videos.
The console suggests domains from recent embeds; select Add beside one to allow it.
Allow direct (no referrer) playback lets the video play when the browser doesn't say which page it's on, as some apps and privacy settings do. Leave it off unless your viewers need it.
When a video is embedded on a site that isn't in the list, the player refuses to start and the request is logged as Domain not allowed.
Country blocking
Under Block users by country, turn on Enabled, then choose the Rule:
- Block these countries: everyone can watch except viewers in the countries you add.
- Allow only these: only viewers in the countries you add can watch.
Type to search and add countries. The console never saves a rule that blocks every viewer: with Allow only these, add at least one country.
The card shows how many requests were blocked this month; select View in Logs to see them.
Encryption
On the Content protection tab, choose how the library's videos are encrypted:
| Option | What it means |
|---|---|
| None | Plain HLS / DASH. Anyone with a video's stream address can download it. |
| ClearKey | AES encryption, with the keys served by OctaVideo. |
| DRM protection | Widevine, FairPlay and PlayReady. Each playback uses a DRM licence from your plan. |
Changing the encryption re-encodes every video in the library:
- Choose the new option, then select Review & confirm…. The console shows how many videos are affected and how long it takes.
- Select Switch and re-encode.
- The checklist on Overview shows the progress until every video is re-encoded.
Static logo watermark
Burn your logo into every rendition of the video.
- Select Upload logo and choose the image.
- Turn on Burn in a logo.
- Set the Opacity and the Position: Top left, Top right, Bottom left or Bottom right. The Preview shows the result.
The logo applies to new uploads. Existing videos get it only after you re-encode them from Encoding.
User-based watermark
The user-based watermark shows each viewer's details over the video, so a screen recording can be traced back to the account it came from.
- Turn on Enabled, then write the Watermark text. Use the fields
{user_email},{user_id}and{date}; each is replaced with the viewer's details when the video plays. - Choose the Movement: Jump every 30 s, Fixed corner or Slow drift.
The viewer's details come from your server's OTP request, so the watermark needs server OTPs. It's the same setting as the one in API & embeds → Custom Backend. See Secure playback.
An Invisible forensic mark is available as an add-on next to the user-based watermark. It's billed per view; see How billing works.