Application Embed View

How the platform embeds playback.

Public playback can embed the input ID directly. Private playback should replace the input ID with a signed token minted by the application backend or Worker.

Public Stream Player iframe

<iframe
  src="https://customer-trwotzge66wby0ca.cloudflarestream.com/bd40aa4ec3803bbcc79b19b6609a3b59/iframe"
  style="border: none; width: 100%; aspect-ratio: 16 / 9;"
  allow="accelerometer; gyroscope; autoplay; encrypted-media; picture-in-picture;"
  allowfullscreen>
</iframe>

Public HLS manifest

https://customer-trwotzge66wby0ca.cloudflarestream.com/bd40aa4ec3803bbcc79b19b6609a3b59/manifest/video.m3u8

Private signed Stream Player iframe

<iframe
  src="https://customer-trwotzge66wby0ca.cloudflarestream.com/<SIGNED_TOKEN>/iframe"
  style="border: none; width: 100%; aspect-ratio: 16 / 9;"
  allow="accelerometer; gyroscope; autoplay; encrypted-media; picture-in-picture;"
  allowfullscreen>
</iframe>

Backend token flow

Viewer requests access to a private session.

Backend validates login, entitlement, payment state, age checks, blocklists, and session time.

Backend signs a short-lived Stream token for the live input or video ID.

Frontend embeds https://customer-trwotzge66wby0ca.cloudflarestream.com/<SIGNED_TOKEN>/iframe.