# Can't get playback security token to work

**URL:** <https://community.wowza.com/t/cant-get-playback-security-token-to-work/95469>\
**Category:** Wowza Streaming Engine\
**Created:** [September 29, 2022, 5:12pm UTC](https://community.wowza.com/t/cant-get-playback-security-token-to-work/95469 "2022-09-29T17:12:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gustavo\_Villegas](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Gustavo\_Villegas](https://community.wowza.com/u/Gustavo_Villegas)\
**Post date:** [September 29, 2022, 5:12pm UTC](https://community.wowza.com/t/cant-get-playback-security-token-to-work/95469/1 "2022-09-29T17:12:27Z")

</div>

Hi there … I’ve been trying to get playback token to work but haven’t been successful following steps in the documentation  
I’m trying to get it to work manually first

My playback URL without token is as following

http://[server\_IP]:1935/token/camtoken1.stream/playlist.m3u8

Based on documentation:  
content path: token/_definst_/camtoken1.stream  
Sharedsecret I’m using: 12345678  
Prefix: wowzatoken

String to generate de HASH should be following  
token/_definst_/camtoken1.stream?12345678&wowzatokendendtime=0&wowzatokenCustomParameter=abcdef

SHA256 of this string is ```  
3f39d01d5178456f30bf235c6ed4e811b325b6b3224249c9aefc42a035157fc7

```auto
BASE64 of the hash is M2YzOWQwMWQ1MTc4NDU2ZjMwYmYyMzVjNmVkNGU4MTFiMzI1YjZiMzIyNDI0OWM5YWVmYzQyYTAzNTE1N2ZjNw==

Playback url 
http://[server_IP]:1935/token/_definst_/camtoken1.stream/playlist.m3u8?wowzatokendendtime=0&wowzatokenCustomerParameter=abcdef&wowzatokenhash=M2YzOWQwMWQ1MTc4NDU2ZjMwYmYyMzVjNmVkNGU4MTFiMzI1YjZiMzIyNDI0OWM5YWVmYzQyYTAzNTE1N2ZjNw==

I get a forbidden access (403) and debug shows 

[token/_definst_]SecureTokenDef:Hash M2YzOWQwMWQ1MTc4NDU2ZjMwYmYyMzVjNmVkNGU4MTFiMzI1YjZiMzIyNDI0OWM5YWVmYzQyYTAzNTE1N2ZjNw==, doesn't match hash calculated, hZ-eMMAXaer9tjWxYQj0T1WjIMSz_MecyQz6aEW8uu8=

Something is obviously wrong. So, what step is the one I'm doing wrong. Wowza's hash is way shorter than the one I calculated.

Thanks
```

---

<div class="post-metadata">

**Author:** ![Rose\_Power-Wowza\_Com](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/rose_power-wowza_com/32/431_2.png) [@Rose\_Power-Wowza\_Com](https://community.wowza.com/u/Rose_Power-Wowza_Com)\
**Post date:** [September 29, 2022, 8:30pm UTC](https://community.wowza.com/t/cant-get-playback-security-token-to-work/95469/2 "2022-09-29T20:30:03Z")

</div>

Hello Gustavo,

Sorry you are having issues, I assume you are sharing this as an example, but you will create all new ones because sharing this has compromised your token security obviously. These posts get thousands of views. As far as the issue you are having that issue, due to privacy we only troubleshoot hash issues through a support ticket.

I’m sure you are aware that SHA-256 has to be 256 characters. So if Wowza is cutting it shorter, please send a ticket and we will troubleshoot for you.

[https://www.wowza.com/docs/how-to-protect-streaming-using-securetoken-in-wowza-streaming-engine](https://www.wowza.com/docs/how-to-protect-streaming-using-securetoken-in-wowza-streaming-engine)