What's the difference between signed URLs, playback tokens, and DRM?
They're three levels of video access control. A signed URL (or playback token) is a time-limited, cryptographically signed link that proves a request is authorized — cheap and enough for most private video. DRM (Widevine, FairPlay, PlayReady) goes further and encrypts the media itself, so even a downloaded file can't be played without a license — heavier, and mainly for premium licensed content.
Signed URLs and playback tokens
A signed URL carries an expiry and a signature the edge verifies before serving. It can't be forged or shared after it expires, and — done right — it protects the manifest *and* every segment, not just the top-level .m3u8. For most private or paid video, this is all you need.
Domain allowlisting
A lighter check: the edge only serves when the request's Referer/Origin is on your allowlist. It's simple and stops casual hotlinking, but it's weaker than a signed token because those headers can be spoofed. Good as a low-friction default (this is the Bunny-style approach).
DRM
DRM encrypts the content itself; the player must fetch a license to decrypt it. That stops the “just download the file and replay it” attack a signed URL doesn't. The cost is real: license servers, per-platform schemes (Widevine, FairPlay, PlayReady), and device support — overkill unless a licensing contract requires it.
Which do you need?
Most apps: short-lived signed tokens, optionally with a domain allowlist. Reach for DRM only when a content owner or contract demands hard copy-protection — it's a big jump in cost and complexity for protection most products don't need.
How rehelios handles it
rehelios gates playback with short-lived signed tokens or a Bunny-style domain allowlist, protecting the manifest and every segment — enough for the vast majority of private and paid video, without running a DRM license server.