# Error using Vod Streaming with token

**URL:** https://community.wowza.com/t/error-using-vod-streaming-with-token/54970
**Category:** Wowza Streaming Engine
**Tags:** vod
**Created:** [April 13, 2020, 12:38pm UTC](https://community.wowza.com/t/error-using-vod-streaming-with-token/54970 "2020-04-13T12:38:33Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![ekrem\_ekrem](https://avatars.discourse-cdn.com/v4/letter/e/cdc98d/32.png) [@ekrem\_ekrem](https://community.wowza.com/u/ekrem_ekrem)
#### Post date: [April 13, 2020, 12:38pm UTC](https://community.wowza.com/t/error-using-vod-streaming-with-token/54970/1 "2020-04-13T12:38:33Z")

</div>

Hello,

I use tokens in vod streaming. But when I test the resulting url address it gives 403 Forbidden error. Can you help me?

Version: 4.8.0

Example code I wrote in Node.js and the setting screenshot I made in wowza panel:

var crypto = require(‘crypto’);

var express = require(‘express’);

var contentURL = ‘[http://192.168.1.1:1935/vod/sample.mp4/playlist.m3u8](http://192.168.1.1:1935/vod/sample.mp4/playlist.m3u8)’

var sharedSecret = ‘xxxxxxxxxx’;

var contentPath = ‘/vod/sample.mp4’;

var customSecureTokenPrefix = ‘myTokenPrefix’;

var CustomParameter = ‘abcdef’;

const date = new Date().valueOf()

var starttime = date;

var endtime = date + 12000;

var toHash = contentPath + ‘?’ +

sharedSecret + ‘&’ +

customSecureTokenPrefix + ‘CustomParameter=’ + CustomParameter + ‘&’ +

customSecureTokenPrefix + ‘endtime=’ + endtime + ‘&’ +

customSecureTokenPrefix + ‘starttime=’ + starttime;

console.log("string for hash : " + toHash);

var hash = crypto.createHash(‘sha256’).

update(toHash, “utf8”).

digest(‘base64’);

hash = hash.replace(///g, ‘\_’);

hash = hash.replace(/+/g, ‘-’);

var hlsURL = '[http://192.168.1.1:1935/vod/sample.mp4/playlist.m3u8?’](http://192.168.1.1:1935/vod/sample.mp4/playlist.m3u8?') +

customSecureTokenPrefix + ‘starttime=’ + starttime + ‘&’ +

customSecureTokenPrefix + ‘endTime=’ + endtime + ‘&’ +

customSecureTokenPrefix + ‘CustomParameter=’ + CustomParameter + ‘&’ +

‘myTokenPrefixhash=’ + hash;

console.log("url for hls : " + hlsURL)

string for hash : string for hash : /vod/sample.mp4?xxxxxxxxxx&myTokenPrefixCustomParameter=abcdef&myTokenPrefixendtime=1586533227613&myTokenPrefixstarttime=1586533215613

url for hls : [http://192.168.116.1:1935/vod/sample.mp4/playlist.m3u8?myTokenPrefixstarttime=1586533215613&myTokenPrefixendTime=1586533227613&myTokenPrefixCustomParameter=abcdef&myTokenPrefixhash=sFKHqXwp8yY4PqOcJhFChAvCEjmyhpgfN2nDo41xrp8=](http://192.168.116.1:1935/vod/sample.mp4/playlist.m3u8?myTokenPrefixstarttime=1586533215613&myTokenPrefixendTime=1586533227613&myTokenPrefixCustomParameter=abcdef&myTokenPrefixhash=sFKHqXwp8yY4PqOcJhFChAvCEjmyhpgfN2nDo41xrp8=)

Thank you.

---

<div class="post-metadata">

### Author: ![Amara\_Graham](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/amara_graham/32/381_2.png) [@Amara\_Graham](https://community.wowza.com/u/Amara_Graham)
#### Post date: [April 10, 2020, 4:22pm UTC](https://community.wowza.com/t/error-using-vod-streaming-with-token/54970/2 "2020-04-10T16:22:33Z")

</div>

Please edit your post and screenshot to remove shared secrets. You do not want that information public!

---

<div class="post-metadata">

### Author: ![Amara\_Graham](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/amara_graham/32/381_2.png) [@Amara\_Graham](https://community.wowza.com/u/Amara_Graham)
#### Post date: [April 13, 2020, 1:49pm UTC](https://community.wowza.com/t/error-using-vod-streaming-with-token/54970/3 "2020-04-13T13:49:39Z")

</div>

Take a look at this post with a PHP code example - [http://community.wowza.com/community/questions/7786/securetoken-protection-in-wowza-streaming-enginehl.html](http://community.wowza.com/community/questions/7786/securetoken-protection-in-wowza-streaming-enginehl.html)