# SecureToken between client & server

**URL:** https://community.wowza.com/t/securetoken-between-client-server/46955
**Category:** Wowza Streaming Engine
**Created:** [April 26, 2016, 2:10pm UTC](https://community.wowza.com/t/securetoken-between-client-server/46955 "2016-04-26T14:10:11Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Avi\_Ortas](https://avatars.discourse-cdn.com/v4/letter/a/e99b99/32.png) [@Avi\_Ortas](https://community.wowza.com/u/Avi_Ortas)
#### Post date: [April 26, 2016, 2:10pm UTC](https://community.wowza.com/t/securetoken-between-client-server/46955/1 "2016-04-26T14:10:11Z")

</div>

Hello All,

I need your help which i didnt success since yesterday to implement this option 🙂 I am trying to do client-server auth with SecureToken hashing but I am always getting 403 acces denied error. I referenced below link but didnt success

[https://www.wowza.com/docs/how-to-protect-streaming-using-securetoken-in-wowza-streaming-engine](https://www.wowza.com/docs/how-to-protect-streaming-using-securetoken-in-wowza-streaming-engine)

ApplicationName = LiveStream

StreamName = myStream

Hash Prefix= live

[blabla.com/LiveStream/myStream?livehash=XXX](http://blabla.com/LiveStream/myStream?livehash=XXX)

in which algortihm what should i hash ? Please help me if you have any solution on this issue for better understanding.

---

<div class="post-metadata">

### Author: ![Paul\_Shields](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/paul_shields/32/390_2.png) [@Paul\_Shields](https://community.wowza.com/u/Paul_Shields)
#### Post date: [April 26, 2016, 3:24pm UTC](https://community.wowza.com/t/securetoken-between-client-server/46955/2 "2016-04-26T15:24:07Z")

</div>

Hi,

Once you’ve configured your Secure Token settings in Wowza Streaming Engine then you need to generate your hash on the client. As an example using PHP to create a hash to play sample.mp4 in the vod application

Set some variables:

[php]

$clientIP = “null”; // specify an IP address if set in Secure Token in Engine

$host = “wowza-ip”; // your ip/host

$url= “rtmp://”.$host.":1935/"; // this is an example for RTMP streams

$stream = “vod/_definst_/mp4:sample.mp4”; // your stream

$start = time(); // token is valid from time of hash generation

$end = strtotime("+30 minutes"); // token will expire in 30 minutes

$secret = “abcde”; // secret as defined in Engine

$tokenName = “wowzatoken”; // token as defined in Engine

[/php]

Calculate the hash (using sha384 or change to what is set in Wowza)

[php]

$hash = “”;

if(is\_null($clientIP)){

$hash = hash(‘sha384’, $stream."?".$secret."&{$tokenName}endtime=".$end."&{$tokenName}starttime=".$start, true); // generate the hash string

}

else {

$hash = hash(‘sha384’, $stream."?".$clientIP."&".$secret."&{$tokenName}endtime=".$end."&{$tokenName}starttime=".$start, true); // generate the hash string

}

$base64Hash = strtr(base64\_encode($hash), ‘+/’, ‘-\_’); $params = array("{$tokenName}starttime=".$start, “{$tokenName}endtime=”.$end, “{$tokenName}hash=”.$base64Hash);

if(!is\_null($clientIP)){

$params[] = $clientIP;

}

sort($params); $URL = $url.$stream."/playlist.m3u8?"; // determine if HLS or RTMP depending on $url

if(preg\_match("/(rtmp)/",$url)){

$playbackURL = $url.$stream."?";

}

foreach($params as $entry){

$playbackURL.= $entry."&";

}

$URL = preg\_replace("/(&)$/","", $playbackURL);

[/php]

This will create a $URL line similar to this:

```auto
rtmp://wowza-ip:1935/vod/_definst_/mp4:sample.mp4?192.168.1.4&wowzatokenendtime=1459767008&wowzatokenhash=y8Iuk-Lq5hIuD0NfLyShZe89T4OXHlqSDezhjqCsClIRS_NIi-SzNDaZQFTPvWwc&wowzatokenstarttime=1459765208

```

you should then be able to test playback, or extend the script to include a player, e.g. JWPlayer etc.

Paul