Change HLS header EXT-X-KEY from chunklist to playlist

In my structure I’ve to authenticate the stream, and I need do it once. Because this I can’t go in my back-end and validate for every chunklist (live stream), so I want put the decrypt key on playlist and authenticate it. I’m using CloudFront, so session is not an option. Another option is put the decryption key in my back-end, but I don’t know how do this.