Skip to main content

How to use authentication

When you launch Accurate.Video using a launch template you can choose to specify the authentication to use with query parameters.

Use OpenID Connect​

Use OpenID Connect when possible. It is the recommended authentication method.

Example: Launch Accurate.Video with authentication enabled
GET https://apps.accurate.video/launch/{application}
    ?launchTemplate=https://example.com/launch-template.json
    &authMethod=oidc
    &authOIDCAuthority=https://example.com/authority
    &authOIDCClientId=5g3srbv1u6q6t97u8m7tcj3dd8

This will activate authentication using OpenID Connect. Before Accurate.Video (AV) loads the launch template the user will need to authenticate through the OpenID Provider (OP). By default, AV uses the access token obtained from the OP when fetching the launch template and calling the configured HTTP publish endpoint. For protected media, add the per-file metadata.

info

You can read more about the specific authentication query parameters in our launch api documentation

Examples​

Okta configuration​

SettingValue
Sign-in redirect URIhttps://apps.accurate.video/launch/{application}

Query parameters​

Query parameterValue
authMethodoidc
authOIDCAuthorityhttps://example.okta.com/oauth2/default
authOIDCClientId5g3srbv1u6q6t97u8m7tcj3dd8

Complete url​

Example: Launch Accurate.Video with authentication enabled for okta
GET https://apps.accurate.video/launch/{application}
?launchTemplate=https://example.com/launch-template.json
&authMethod=oidc
&authOIDCAuthority=https://example.okta.com/oauth2/default
&authOIDCClientId=5g3srbv1u6q6t97u8m7tcj3dd8

Use a token​

To supply a token such as a JWT, set authMethod=token and pass the token in the token query parameter:

Example: Launch Validate with token authentication
GET https://apps.accurate.video/launch/validate
    ?launchTemplate=https://example.com/launch-template.json
    &authMethod=token
    &token=<JWT>

Replace <JWT> with your token and URL-encode query parameter values. Accurate.Video uses Authorization: Bearer <JWT> by default.

To read the token from a different query parameter, set authTokenParameter to that parameter's name. To change Bearer, set authTokenPrefix. For example, authMethod=token&authTokenParameter=access_token&access_token=<JWT>&authTokenPrefix=Token sends Authorization: Token <JWT>.

Accurate.Video sends the header when fetching the launch template and calling the configured HTTP publish endpoint, unless the endpoint overrides or disables it. See authenticated request coverage for the limits.

Authenticate protected media files​

To send the authentication header on HLS or DASH manifest and segment requests, add av:useAuthHeaderOnRequest with the string value "true" to the video file's metadata array:

Example: Protected HLS file in data.assets[].files[]
{
  "id": "V-1",
  "type": "VIDEO",
  "url": "https://example.com/video.m3u8",
  "container": {
    "format": "hls",
    "videoStreams": [
      {
        "frameRateNumerator": 24,
        "frameRateDenominator": 1
      }
    ],
    "audioStreams": [
      {
        "channels": 2
      }
    ]
  },
  "metadata": [
    {
      "key": "av:useAuthHeaderOnRequest",
      "value": "true"
    }
  ]
}

For protected waveform files, add the same metadata to each waveform file. Keep the required waveform:source_file_id and waveform:track metadata. The video file's flag does not apply to its waveform files.

This flag requires authentication, either token or OIDC. It does not add the header to thumbnails, sprite maps, still frames, or progressive video and audio loaded directly by the browser. Use another access mechanism, such as presigned URLs, for those files.