Configure secure access to content

Last update: October 05 2026Open in Markdown

By default, any user can access your content.

You can configure secure access to content — by a code word or by your own script.

Configure access by code word

Configuring access by code word (Tokenized URL) allows you to make content links temporary and restrict access to content by IP address.

A token in the format md5(kymJ2w55VH4LUMSKGb6ZqA,1704067200) is added to the website links. The token is added using a script that you customize and host on your server. The token is generated as follows:

• a code word you have created;
• the file path on the origin;
• optionally: an allowed IP address;
• optionally: link expiration time in POSIX time format.

As a result, the secure link with a token will look like this:

https://cdn.example.com/md5(kymJ2w55VH4LUMSKGb6ZqA,1704067200)/path/to/file.png.

When a user follows a link, CDN servers verify the token in the request. If the token is valid and the link has not expired, the servers provide the content. CDN servers receive content from the origin regardless of whether a code word is used.

1. In the Control panel, in the top menu, click Products and select CDN.

2. In the CDN resources section, open the CDN resource page → tab Restrictions.

3. In the Authorization block, select By code word.

4. Enter a code word between 6 and 32 characters long. You can use Latin letters and digits.

5. Optional: to make the link permanent, select the Do not limit by time checkbox. If you leave the checkbox unselected, the link lifetime will need to be specified in the script. Learn more in the Examples of a script for generating a secure link subsection.

6. Optional: to make the content accessible from any IP address, select the Do not consider IP checkbox. If you leave the checkbox unselected, the IP addresses will need to be specified in the script. Learn more in the Examples of a script for generating a secure link subsection.

7. Click Apply. While the settings are being applied, the CDN resource will be in the PROCESSING status. During this time, applying other settings is unavailable. The settings will be applied once the CDN resource switches to the ACTIVE status.

8. Configure link generation with a token on the server using a script. You can view script examples in the Examples of a script for generating a secure link subsection.

Script examples for generating a secure link

For your information

These are script examples for generating a token taking into account IP address and link expiration time restrictions. If you do not want to specify IP addresses and link expiration time, remove these parameters from the script.

PHP script

<?php
$secret = '<code_word>';
$ip = '<ip_address>';
$path = '<path>';
$lifetime = <link_lifetime>;
$expires = time() + $lifetime;
$link = "$secret$path$ip$expires";
$md5 = md5($link, true);
$md5 = base64_encode($md5);
$md5 = strtr($md5, '+/', '-_');
$md5 = str_replace('=', '', $md5);
$domain = '<domain>';
$url = "$domain/md5($md5,$expires)$path";
echo $url;
echo "\n";

Specify:

• <code_word> — code word specified when configuring access to content by code word;

• <ip_address> — IP address from which access to the content is allowed;

• <path> — relative path to the file or the path prefix on the origin. For example, there is a relative path to the file: /path/to/file.jpg. To grant access:

  • to a specific file, specify: /path/to/file.jpg;
  • to all files starting with /path/to/, including subfolders, specify: /path/to;
  • to all files in /path/ and its subfolders, specify: /path;

• <link_lifetime> — link lifetime in seconds;

• <domain> — CDN resource domain with protocol specified, for example https://cdn.example.com. You can view the CDN resource domain in the Control panel: in the top menu, click Products → CDN → CDN resources → CDN resource row.

Python script

import base64
from hashlib import md5
from time import time

secret = "<code_word>"
ip = "<ip_address>"
path = "<path>"
lifetime = <link_lifetime>
domain = "<domain>"

expires = int(time()) + lifetime

token_byte = base64.encodebytes(
    md5(f"{secret}{path}{ip}{expires}".encode("utf-8")).digest()
)
token = (
    token_byte
    .decode("utf-8")
    .replace("\n", "")
    .replace("+", "-")
    .replace("/", "_")
    .replace("=", "")
)
secured_url = f"{domain}/md5({token},{expires}){path}"
print(secured_url)

Specify:

• <code_word> — code word specified when configuring access to content by code word;

• <ip_address> — IP address from which access to the content is allowed;

• <path> — relative path to the file or the path prefix on the origin. For example, there is a relative path to the file: /path/to/file.jpg. To grant access:

  • to a specific file, specify: /path/to/file.jpg;
  • to all files starting with /path/to/, including subfolders, specify: /path/to;
  • to all files in /path/ and its subfolders, specify: /path;

• <link_lifetime> — link lifetime in seconds;

• <domain> — CDN resource domain with protocol specified, for example https://cdn.example.com. You can view the CDN resource domain in the Control panel: in the top menu, click Products → CDN → CDN resources → CDN resource row.

OpenSSL script

SECRET="<code_word>"
IP="<ip_address>"
FILE_PATH="<path>"
LIFETIME=<link_lifetime>
DOMAIN="<domain>"

EXPIRES=$(($(date +%s) + LIFETIME))

HASH_STRING="${SECRET}${FILE_PATH}${IP}${EXPIRES}"

TOKEN=$(echo -n "$HASH_STRING" | openssl md5 -binary | openssl base64 | tr '+/' '-_' | tr -d '=')

SECURED_URL="${DOMAIN}/md5(${TOKEN},${EXPIRES})${FILE_PATH}"

echo "$SECURED_URL"

Specify:

• <code_word> — code word specified when configuring access to content by code word;

• <ip_address> — IP address from which access to the content is allowed;

• <path> — relative path to the file or the path prefix on the origin. For example, there is a relative path to the file: /path/to/file.jpg. To grant access:

  • to a specific file, specify: /path/to/file.jpg;
  • to all files starting with /path/to/, including subfolders, specify: /path/to;
  • to all files in /path/ and its subfolders, specify: /path;

• <link_lifetime> — link lifetime in seconds;

• <domain> — CDN resource domain with protocol specified, for example https://cdn.example.com. You can view the CDN resource domain in the Control panel: in the top menu, click Products → CDN → CDN resources → CDN resource row.

Configure access by your own script

You can add your own script to authorize users.

When a user follows the link, the content access decision is made based on the response from the script.

The following headers are passed in the request to the script:

• Host — domain name for which the request is intended;
• X-Request-URI — URI of the requested CDN resource;
• X-Forwarded-For — real IP address of the user requesting the CDN resource;
• X-Remote-Addr — IP address of the user requesting the CDN resource or IP address of the proxy server.

1. In the Control panel, in the top menu, click Products and select CDN.

2. In the CDN resources section, open the CDN resource page → tab Restrictions.

3. In the Authorization block, select By external script.

4. Paste the script URL.

5. Click Apply. While the settings are being applied, the CDN resource will be in the PROCESSING status. During this time, applying other settings is unavailable. The settings will be applied once the CDN resource switches to the ACTIVE status.