How to secure live streams: stream keys, private links, guest keys and IP rules

Most live streaming leaks are not hacks. Someone pastes a stream key into a group chat, a private event link gets forwarded, or an embed turns up on a site it was never meant for. Each has a simple control, as long as you think about both doors: the one video comes in through, and the one viewers go out through.

Two doors, two sets of locks

Who may send

Treat the stream key as a password

Anyone with your key can broadcast as you. Never show it on screen, never put it in a shared document, and renew it the moment it might have leaked: the old key stops working at once, and you paste the new one into your encoder.

Give guests their own key

A remote presenter or a second venue should never get your key. Make a guest key with an expiry. For extra safety choose "for one connection only": once they start, nobody can reuse it, not even them.

Encrypt anything that crosses the internet

Plain RTMP sends the key and the picture in the clear. Use SRT with an AES passphrase, or RTMPS/RTSPS if your server has a domain and certificate. Once SRT encryption is on, the server refuses SRT without the passphrase. (How SRT copes with lost packets is in SRT vs RTMP vs WHIP.)

Allow only your encoder's address

For a fixed encoder, list the addresses it sends from. Anything else is turned away. For MPEG-TS over UDP, which has no key at all, this is the only lock, so creekX requires it.

Who may watch

Public link, private link, or both

The public watch link (and the embed that uses it) can be switched on and off. Make a new link stops the old link and every copy of the old embed at once. For a paid event or a single client, make a private link: it plays even with the public link off, and stops by itself when its time is up. Choose one viewer only and it plays only where it was first opened; forwarded, it does nothing.

Limit viewing to places

For an office, school or venue, list the addresses that may watch, a single address like 203.0.113.7 or a range like 203.0.113.0/24. The watch page, the website player and player apps then work only from there.

Block a network

A blocked network cannot watch any of your streams or join the chat, and clearing browser data does not get round it. Use it carefully: offices, cafés and mobile networks put many people behind one address.

Know the one limit

Watch access is checked when playback starts. Revoking a link stops new viewers immediately, but a session already playing carries on until the viewer leaves. For a genuine emergency, take the stream itself off air. If a vendor promises otherwise, ask how they cut a connection that is already open.

A five-minute checklist

1. Keys renewed after anyone left the team; guests on guest keys.
2. SRT with a passphrase, or RTMPS, for every remote encoder.
3. Fixed encoders limited to their own addresses.
4. Private events on private, expiring links.
5. Internal streams limited to your networks.

The same controls from code

A private link for one viewer, valid for two hours. The answer holds the link and a signed token:

curl -X POST https://live.example.com/v1/streams/STREAM_ID/tokens \
  -H "X-CreekX-Key: YOUR-API-KEY" -H "content-type: application/json" \
  -d '{"use":"play","expiresInSeconds":7200,"oneTime":true}'

The token is a JWT signed with HS256. Its payload, decoded and annotated:

{
  "sub": "eebc8cd3-14d5-4ea1-b9b0-aa8c483d67a7",   // the stream
  "use": "play",                                   // or "publish" for a guest key
  "exp": 1792091945,                               // when it stops
  "jti": "6678ce65-2b48-41b8-9636-fc772ca865a6",   // its own id, so it can be revoked
  "one": true                                      // one viewer only
}

Renew a leaked stream key, encrypt SRT, and stop every token made so far:

curl -X POST https://live.example.com/v1/streams/STREAM_ID/key/rotate -H "X-CreekX-Key: YOUR-API-KEY"
curl -X POST https://live.example.com/v1/streams/STREAM_ID/srt-passphrase -H "X-CreekX-Key: YOUR-API-KEY"
curl -X POST https://live.example.com/v1/streams/STREAM_ID/tokens/revoke -H "X-CreekX-Key: YOUR-API-KEY"

Limit who may send and who may watch, by address:

curl -X PATCH https://live.example.com/v1/streams/STREAM_ID \
  -H "X-CreekX-Key: YOUR-API-KEY" -H "content-type: application/json" \
  -d '{"publishFrom":["198.51.100.20"],"watchFrom":["203.0.113.0/24"]}'

Webhooks are signed too (HMAC-SHA256); the REST API quick start has the code to check them.