Restricting who can play video stored in R2.
Private objects plus expiring signed URLs are the mechanism. It is genuinely useful and it is not DRM. This page is precise about which threats it stops.
Short answer
Signed URLs stop link sharing, not screen recording.
Keep the bucket private and issue short-lived signed URLs to authorised viewers. A copied link stops working when it expires, and domain restrictions can stop the stream from playing on sites you did not approve. That covers casual redistribution, which is what most catalogues actually lose revenue to.
It does not encrypt content against an authorised viewer. Anyone who can watch can record their screen. If a contract requires Widevine or FairPlay, this approach does not satisfy it and we will say so rather than call it DRM.
Estimate this workload in the calculator See how BYO storage works
Threat model
What this does and does not stop.
Being specific here matters more than sounding secure.
Stops: shared links
An expired signature is rejected at the edge, so a link pasted into a group chat is dead within its window.
Stops: hotlinking
Domain restrictions reject playback initiated from origins you did not approve, so another site cannot embed your video.
Does not stop: recording
An authorised viewer can capture their own screen. No signed-URL scheme prevents this, and neither does consumer DRM in practice.
Comparison
Protection levels, honestly labelled.
| Mechanism | Stops shared links | Stops recording | Needs a licence server |
|---|---|---|---|
| Public URL | No | No | No |
| Signed expiring URL | Yes | No | No |
| Signed URL + domain restriction | Yes | No | No |
| Widevine / FairPlay DRM | Yes | Partly | Yes |
NULX implements the middle two rows. The DRM row is listed for comparison and is not something NULX provides.
Common questions
Access questions worth answering plainly.
Is signed playback the same as DRM?
No. DRM encrypts content and enforces decryption through a licence server on the client. Signed URLs authorise a request. We do not describe our signed playback as DRM.
How long should a signature last?
Long enough to start and continue playback, short enough that a leaked link is worthless. Minutes rather than days is the usual answer, with renewal during long viewing.
Can I revoke access to a video immediately?
Rotating the signing secret invalidates outstanding URLs. Already-buffered segments on a viewer's device are outside anyone's reach.
Does the bucket have to be private?
Yes. Signed URLs are pointless if the same objects are also reachable without a signature.
Sources
Rates checked September 10, 2026 · Page updated September 10, 2026
Next step
See the playback controls.
Signed URLs, expiry windows and domain restrictions are configured per folder, on video that stays in your bucket.