Signed watch links
Issue protected links for a specific viewing route instead of exposing an open stream address.
Viewer Access Control
Control who can watch - and keep a viewer record
When a live stream should not be public, CreekX lets you decide who can open it. Use signed watch links, one-time viewer tokens, IP rules or an approval check through your own system. Viewer connection logs record any available viewer identity, device, IP address and time. The controls and logs run on the server where you deploy CreekX.
CreekX Media Server
Choose where the access decision is made
CreekX can apply its own link and network rules or ask your existing system for a decision. You can require approval before a stream starts, before a viewer begins playback, or at both points. If an enabled customer-system check does not answer, CreekX refuses access.
One-time viewer tokens
Give a viewer a token that can be used once, reducing the risk of a reusable link being passed around.
IP allow-lists and blocks
Permit or refuse playback according to the viewer’s IP address.
Customer-system approval
Let your application or access system approve each stream or viewer before CreekX proceeds.
What happens when someone presses play
CreekX checks the controls configured for that stream before returning video. The exact path depends on whether you use built-in protection, an external approval check or both.
- CreekX receives the playback request and validates the signed link or one-time viewer token.
- Configured IP rules are applied before viewing begins.
- If customer-system approval is enabled, CreekX requests a decision and refuses access when that system does not respond.
- An approved viewer receives the stream; a refused viewer does not.
- The connection is added to the viewer log with its available identity, device, IP address and time.
Records for viewing and administrative changes
The viewer connection log and administrative audit log serve different purposes, so playback activity is not mixed with configuration changes.
Viewer connection log
Shows any available viewer identity, the device and IP address used, and when the connection occurred. The log remains on your CreekX server.
Administrative audit log
Records administrative actions. Entries are linked in a hash chain so changes to recorded entries can be detected.
Where controlled viewing fits
Restricted live broadcasts
Limit sports, auction and other live feeds to viewers who have an approved link, token or access decision.
Camera and site access
Assign people to the camera sites they are permitted to see, with the server enforcing those permissions.
Field and control-room viewing
Provide view-only access on browsers, tablets or the locked Android kiosk player without giving viewers administrative controls.
Workspaces, camera sites and sign-in
Separate workspaces are isolated at the database level. For CreekX Cameras, each person can access only the camera sites they are allowed to see, and the server enforces that boundary. OpenID Connect single sign-on is supported, but testing so far has used a test identity provider rather than every commercial provider.
- CreekX does not include built-in two-factor authentication. An OpenID Connect identity provider can enforce its own two-factor policy.
- SAML is not supported.
- Use the REST API and webhooks when access decisions need to connect with another application.
Security and data boundaries
Viewer controls protect access to playback, but they are not a formal security assessment. CreekX does not currently have a formal security certification, independent penetration test or external audit. Its stated security features have been checked through the company’s own automated tests.
- The application and video use HTTPS in transit, while WebRTC media uses DTLS-SRTP.
- Stream keys, camera passwords and other stored credentials are sealed with AES-256-GCM.
- Recorded video and library files are not encrypted by CreekX on the server’s disks. Use server-level disk encryption when encryption at rest is required.
- CreekX sends no telemetry. Viewer and audit logs stay on your server.
- Optional off-site backups, external storage and other outbound integrations create data paths when you enable them.
Evaluate the controls directly
The public documentation covers viewer security, single sign-on and API access. Developers and technical buyers can also use the Media Server trial to test protected playback on their own server.
Fourteen-day Media Server trial
The trial requires no credit card and includes all Pro features. It permits up to five 24/7 channels, five restream destinations per stream and 500 library videos.
Public technical resources
CreekX provides 24 public guides and an OpenAPI 3.1 REST API reference for implementation and evaluation.
Test Media Server or discuss an assisted deployment
The Media Server trial needs internet during installation and does not include the CreekX Cameras portal. Speak to CreekX first if you need a camera pilot, a fully offline or air-gapped installation, several servers, more than 50 live streams, thousands of viewers, tender documents or Enterprise services.