# SecureToken between client & server

**URL:** <https://community.wowza.com/t/securetoken-between-client-server/46955>\
**Category:** Wowza Streaming Engine\
**Created:** [April 26, 2016, 2:10pm UTC](https://community.wowza.com/t/securetoken-between-client-server/46955 "2016-04-26T14:10:11Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Paul\_Shields](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/paul_shields/32/390_2.png) [@Paul\_Shields](https://community.wowza.com/u/Paul_Shields)\
**Post date:** [April 26, 2016, 3:24pm UTC](https://community.wowza.com/t/securetoken-between-client-server/46955/2 "2016-04-26T15:24:07Z")

</div>

Hi,

Once you’ve configured your Secure Token settings in Wowza Streaming Engine then you need to generate your hash on the client. As an example using PHP to create a hash to play sample.mp4 in the vod application

Set some variables:

[php]

$clientIP = “null”; // specify an IP address if set in Secure Token in Engine

$host = “wowza-ip”; // your ip/host

$url= “rtmp://”.$host.":1935/"; // this is an example for RTMP streams

$stream = “vod/_definst_/mp4:sample.mp4”; // your stream

$start = time(); // token is valid from time of hash generation

$end = strtotime("+30 minutes"); // token will expire in 30 minutes

$secret = “abcde”; // secret as defined in Engine

$tokenName = “wowzatoken”; // token as defined in Engine

[/php]

Calculate the hash (using sha384 or change to what is set in Wowza)

[php]

$hash = “”;

if(is\_null($clientIP)){

$hash = hash(‘sha384’, $stream."?".$secret."&{$tokenName}endtime=".$end."&{$tokenName}starttime=".$start, true); // generate the hash string

}

else {

$hash = hash(‘sha384’, $stream."?".$clientIP."&".$secret."&{$tokenName}endtime=".$end."&{$tokenName}starttime=".$start, true); // generate the hash string

}

$base64Hash = strtr(base64\_encode($hash), ‘+/’, ‘-\_’); $params = array("{$tokenName}starttime=".$start, “{$tokenName}endtime=”.$end, “{$tokenName}hash=”.$base64Hash);

if(!is\_null($clientIP)){

$params[] = $clientIP;

}

sort($params); $URL = $url.$stream."/playlist.m3u8?"; // determine if HLS or RTMP depending on $url

if(preg\_match("/(rtmp)/",$url)){

$playbackURL = $url.$stream."?";

}

foreach($params as $entry){

$playbackURL.= $entry."&";

}

$URL = preg\_replace("/(&)$/","", $playbackURL);

[/php]

This will create a $URL line similar to this:

```auto
rtmp://wowza-ip:1935/vod/_definst_/mp4:sample.mp4?192.168.1.4&wowzatokenendtime=1459767008&wowzatokenhash=y8Iuk-Lq5hIuD0NfLyShZe89T4OXHlqSDezhjqCsClIRS_NIi-SzNDaZQFTPvWwc&wowzatokenstarttime=1459765208

```

you should then be able to test playback, or extend the script to include a player, e.g. JWPlayer etc.

Paul

---

_[View the full topic](https://community.wowza.com/t/securetoken-between-client-server/46955)._