M3U8 signature

Updated at：2025-11-03

M3U8 signature

API description

M3U8 signature applies to M3U8 files in private spaces, primarily used for authorizing batch downloads of TS resources listed in M3U8 files. Access permission is temporarily granted by rewriting the URL of TS resources to a private URL.

Permission description

The Access Key and request signature mechanism are uniformly adopted for all API security authentication. Access Key consists of an Access Key ID and a Secret Access Key, both of which are strings. For each HTTP request, use the algorithm described below to generate a authentication string. Submit the certification string in the Authorization header. The server verifies the correctness of the authentication string based on the generation algorithm. The certification string format is bce-auth-v{version}/{accessKeyId}/{timestamp}/{expirationPeriodInSeconds}/{signedHeaders}/{signature}.

The version is a positive integer.
The timestamp refers to the UTC time when the signature is created.
The expirationPeriodInSeconds specifies the duration during which the signature remains valid.
SignedHeaders includes the list of headers involved in the signature algorithm. The headers are separated by semicolons (e.g., host;x-bce-date) and arranged in lexicographical order. (This API signature involves only the host and x-bce-date headers.)
The signature is a 256-bit signature represented as a 64-character lowercase hexadecimal digest.

When Baidu AI Cloud receives a user's request, the system uses the same SK and certification mechanism to generate a certification string. This string is then compared with the one included in the user's request. If the two match, the system confirms the user has the required permissions and proceeds with the operation. If they differ, the system cancels the operation and returns an error code.

For detailed information on the authentication mechanism, please refer to [Authentication](Reference/Authentication mechanism/Introduction.md).

Notes

If the request does not include signature certification information, this API will return the object's original data as is.

Request structure

Plain Text

1GET /<ObjectName>?x-bce-process=hls/sign,expires_3600 HTTP/1.1
2Host: <BucketName>.bj.bcebos.com
3Authorization: authorization string

Request headers

There are no special headers required beyond the common headers.

Request query parameters

Parameter name	Types	Description
x-bce-process	string	BOS data processing parameters: Obtain the M3U8 signature as x-bce-process=hls/sign,expires_xxx

Operation category: hls
Operation name: sign

The M3U8 signature API parameters are defined as follows:

Parameter description

Parameter name	Types	Value	Command description	Required or not
expires	int	[3600,43200]	Generate signature expiration time (in seconds)	Yes

Usage example

Plain Text

1GET http://databin.bj.bcebos.com/hls/demo.m3u8?x-bce-process=hls/sign,expires_3600
2Host: databin.bj.bcebos.com
3X-Bce-Date:2022-11-16T11:54:00Z
4Authorization: bce-auth-v1/f81d3b34e48048fbb2634dc7882d7e21/2015-08-11T04:17:29Z/3600/host/74c506f68c65e26c633bfa104c863fffac5190fdec1ec24b7c03eb5d67d2e1de

The original M3U8 link and content are as follows:

Plain Text

1#EXTM3U
2#EXT-X-VERSION:3
3#EXT-X-MEDIA-SEQUENCE:0
4#EXT-X-ALLOW-CACHE:YES
5#EXT-X-TARGETDURATION:62
6#EXTINF:61.120000,
7000000.ts
8#EXTINF:59.360000,
9000001.ts
10#EXTINF:59.640000,
11000002.ts
12#EXTINF:2.480000,
13000003.ts
14#EXT-X-ENDLIST

Use the M3U8 signature API for M3U8 resources to retrieve the corresponding batch-authorized download URLs:

Plain Text

1#EXTM3U
2#EXT-X-VERSION:3
3#EXT-X-MEDIA-SEQUENCE:0
4#EXT-X-TARGETDURATION:62
5#EXTINF:61.120,
6000000.ts?x-bce-security-token=ZjkyZmQ2YmQxZTQ3NDcyNjk0ZTg1ZjYyYjlkZjNjODB8AAAAALECAABEAdI6kNdjSB%2BTmHpMSc0dMXaWHGlooj7S5Db3cCJveP%2BeiUwao6%2FlWgUhpzSWB%2BO2LT3tC%2BZpBv2umQRVUmn3MX%2FwbjjpuOkINK9mFUmjOQpWs7rO9msV84e9oXbMuiwUwEF9OiKsCqntaiY4zu3sx9v0cwI5tGbW5mUmDkQa3C1HSLLZS9E5XAY56O10fxauSymZ9Pdd0yTYG383W0wJbg4FQEzNU6yrnBxvouX8TNZHKfZ4v9VR%2FgyICPChGByiOp%2Fsx%2BP0V7xE1RrhUKPRG3ZB%2Fn1wqVcXEVudgz6yJZ0cj5e0oC0s6ze6BVc8ML51EzNQv1QL802hYeydc7UFMwtEkzgQrRPQ9hjtgobJte%2BlPGdgnxZ61ThjmRzrhL64CoZMjwQnn0nyDZuRbcpStDB9D%2B00gJS4ORwup9RuVqNd7yaPnAzs02ggvbykeUpir2bGeJveBGi45r2ZVoS%2FFuKviXEW2eslHEwH8kYps0YvOndUbLG9SO0PjLPWERVd4%2Bmdw%2FM3b5ItfFpOXkOu&authorization=bce-auth-v1%2Fd7c4970a293311eeaaccb55a6be64ec1%2F2023-07-23T08%3A35%3A13Z%2F3600%2Fhost%2Ffec8f161023133c69368b58f33eeb88650fc0e9829833c5fb8dd43a823f8eaf0
7#EXTINF:59.360,
8000001.ts?x-bce-security-token=ZjkyZmQ2YmQxZTQ3NDcyNjk0ZTg1ZjYyYjlkZjNjODB8AAAAALECAABEAdI6kNdjSB%2BTmHpMSc0dMXaWHGlooj7S5Db3cCJveP%2BeiUwao6%2FlWgUhpzSWB%2BO2LT3tC%2BZpBv2umQRVUmn3MX%2FwbjjpuOkINK9mFUmjOQpWs7rO9msV84e9oXbMuiwUwEF9OiKsCqntaiY4zu3sx9v0cwI5tGbW5mUmDkQa3C1HSLLZS9E5XAY56O10fxauSymZ9Pdd0yTYG383W0wJbg4FQEzNU6yrnBxvouX8TNZHKfZ4v9VR%2FgyICPChGByiOp%2Fsx%2BP0V7xE1RrhUKPRG3ZB%2Fn1wqVcXEVudgz6yJZ0cj5e0oC0s6ze6BVc8ML51EzNQv1QL802hYeydc7UFMwtEkzgQrRPQ9hjtgobJte%2BlPGdgnxZ61ThjmRzrhL64CoZMjwQnn0nyDZuRbcpStDB9D%2B00gJS4ORwup9RuVqNd7yaPnAzs02ggvbykeUpir2bGeJveBGi45r2ZVoS%2FFuKviXEW2eslHEwH8kYps0YvOndUbLG9SO0PjLPWERVd4%2Bmdw%2FM3b5ItfFpOXkOu&authorization=bce-auth-v1%2Fd7c4970a293311eeaaccb55a6be64ec1%2F2023-07-23T08%3A35%3A13Z%2F3600%2Fhost%2F3d146f7de5ec5390a364bcf3ab4da8da7d264567c88371cf77c0817b26a22af6
9#EXTINF:59.640,
10000002.ts?x-bce-security-token=ZjkyZmQ2YmQxZTQ3NDcyNjk0ZTg1ZjYyYjlkZjNjODB8AAAAALECAABEAdI6kNdjSB%2BTmHpMSc0dMXaWHGlooj7S5Db3cCJveP%2BeiUwao6%2FlWgUhpzSWB%2BO2LT3tC%2BZpBv2umQRVUmn3MX%2FwbjjpuOkINK9mFUmjOQpWs7rO9msV84e9oXbMuiwUwEF9OiKsCqntaiY4zu3sx9v0cwI5tGbW5mUmDkQa3C1HSLLZS9E5XAY56O10fxauSymZ9Pdd0yTYG383W0wJbg4FQEzNU6yrnBxvouX8TNZHKfZ4v9VR%2FgyICPChGByiOp%2Fsx%2BP0V7xE1RrhUKPRG3ZB%2Fn1wqVcXEVudgz6yJZ0cj5e0oC0s6ze6BVc8ML51EzNQv1QL802hYeydc7UFMwtEkzgQrRPQ9hjtgobJte%2BlPGdgnxZ61ThjmRzrhL64CoZMjwQnn0nyDZuRbcpStDB9D%2B00gJS4ORwup9RuVqNd7yaPnAzs02ggvbykeUpir2bGeJveBGi45r2ZVoS%2FFuKviXEW2eslHEwH8kYps0YvOndUbLG9SO0PjLPWERVd4%2Bmdw%2FM3b5ItfFpOXkOu&authorization=bce-auth-v1%2Fd7c4970a293311eeaaccb55a6be64ec1%2F2023-07-23T08%3A35%3A13Z%2F3600%2Fhost%2F9bfe3ff75fba9a48fc22b212ba7168810b82540fe656aac3da4f8960d2a58939
11#EXTINF:2.480,
12000003.ts?x-bce-security-token=ZjkyZmQ2YmQxZTQ3NDcyNjk0ZTg1ZjYyYjlkZjNjODB8AAAAALECAABEAdI6kNdjSB%2BTmHpMSc0dMXaWHGlooj7S5Db3cCJveP%2BeiUwao6%2FlWgUhpzSWB%2BO2LT3tC%2BZpBv2umQRVUmn3MX%2FwbjjpuOkINK9mFUmjOQpWs7rO9msV84e9oXbMuiwUwEF9OiKsCqntaiY4zu3sx9v0cwI5tGbW5mUmDkQa3C1HSLLZS9E5XAY56O10fxauSymZ9Pdd0yTYG383W0wJbg4FQEzNU6yrnBxvouX8TNZHKfZ4v9VR%2FgyICPChGByiOp%2Fsx%2BP0V7xE1RrhUKPRG3ZB%2Fn1wqVcXEVudgz6yJZ0cj5e0oC0s6ze6BVc8ML51EzNQv1QL802hYeydc7UFMwtEkzgQrRPQ9hjtgobJte%2BlPGdgnxZ61ThjmRzrhL64CoZMjwQnn0nyDZuRbcpStDB9D%2B00gJS4ORwup9RuVqNd7yaPnAzs02ggvbykeUpir2bGeJveBGi45r2ZVoS%2FFuKviXEW2eslHEwH8kYps0YvOndUbLG9SO0PjLPWERVd4%2Bmdw%2FM3b5ItfFpOXkOu&authorization=bce-auth-v1%2Fd7c4970a293311eeaaccb55a6be64ec1%2F2023-07-23T08%3A35%3A13Z%2F3600%2Fhost%2F04fdee6283aeb8c9be1a6ea042887986ff9368be1b187adb74351dcc3793b2ce
13#EXT-X-ENDLIST

Note: The ts resource signature is based on the URL of the object in the same directory as the M3U8 file.

Taking the above M3U8 file as an example, if the object URL is http://databin.bj.bcebos.com/hls/demo.m3u8, the actual signed URL for the internal file 000000.ts is http://databin.bj.bcebos.com/hls/000000.ts

Multimedia cloud processing

Get video metadata

BOS

BOS

M3U8 signature

M3U8 signature

API description

Request structure

Request headers

Request query parameters

Usage example