How to Turn On Video Encryption

Video encryption in DynTube is HLS AES: each video is packaged with a unique 128-bit key, and the player must fetch that key from DynTube before it can decrypt and play the stream. It is a project-level setting — you turn it on for a project, and it governs the videos that project converts from then on.

Before You Start

All four of these must be true, or the switch is not shown, or the save is refused:

• Your plan includes the Video Encryption feature. The switch is only rendered when your plan carries it, and the API independently re-checks the same feature when the project is saved
• You have the Manage Projects permission — the create and edit project pages require it
• The project is a video project, and Adaptive Streaming (HLS) is on. HLS AES encrypts plain TS-HLS output, so a project with HLS off has nothing to encrypt
• CMAF streaming and Certified DRM are off for that project

Security settings change where and how viewers can play your videos. Turn this on for one project and test playback on a page you control before applying it across your library.

Turn On Encryption for a Project

1. Log in to your DynTube dashboard.
2. In the sidebar, open Video Library (/projects).
3. Open the project you want to protect and edit it — the edit page is /projects/edit/<PROJECT_ID>.
4. Stay on the Details tab.
5. Under Video output settings, make sure HLS streaming is on and CMAF streaming is off. Turning CMAF on turns HLS AES off in the same action, because the two outputs are alternatives.
6. Scroll to Playback protection and turn on Encrypt Video Playback.
7. Click Save Changes.

If the Playback protection section is not on the page at all, one of the first three prerequisites is unmet: the plan feature, or HLS output on a video project. The section is not rendered when there is no control to show.

What the Server Refuses to Save

These combinations are rejected by the project API, not merely discouraged. If you drive DynTube through the API rather than the dashboard, expect these exact refusals:

Which Videos Are Encrypted

The setting is read when a video is converted. Turning it on marks the project, so conversions that run after the save produce encrypted output.

• Videos uploaded to the project after you save are packaged with encryption
• Videos already converted keep the packaging they were produced with — saving the project does not re-encrypt existing output, and DynTube does not re-run finished conversions for you
• To protect an already-converted video, put it through a fresh conversion after the setting is on
• Turning encryption off works the same way: existing encrypted videos stay encrypted and keep needing a key

How the Key Is Delivered

The encrypted playlist points at a DynTube key URL. The player requests it during playback and the request is authorised before any key bytes are returned:

https://<your-playback-host>/v2/videos/hls-key/<KID>/<VIDEO_KEY>?token=<PLAYBACK_TOKEN>

• A valid, current playback token for that specific video is required — a key URL copied out of a playlist is not usable on its own
• Your account's allowed-domains list is applied to the key request when that list is NOT empty. If the list is empty there is no origin restriction, so encryption alone does not limit where a stream can be embedded
• An account-level setting can exempt key requests from the allowed-domains check. If that is set, key delivery is not domain-restricted even when your allowlist is populated
• Country and IP restrictions, apps-only playback and any access gate on the content are evaluated on the key request too

Verify It

Do this yourself after saving — the checks below are the proof, and this article does not assert the outcome on your account's behalf:

1. Upload a test video to the project after saving, and wait for it to finish processing.
2. Play it on a page you control and confirm it plays.
3. Open the browser's network panel during playback and confirm a request to a /v2/videos/hls-key/ URL is made and returns successfully.
4. If your allowed-domains list is populated, embed the same video on a domain that is NOT on the list and confirm playback is refused there.

Troubleshooting

The encryption switch is missing

• Confirm your plan includes Video Encryption
• Confirm the project is a video project with HLS streaming on — a project set to CMAF has no HLS AES control

The switch turned itself off

• Turning on CMAF streaming clears HLS AES in the same action; so does enabling Certified DRM
• Turning HLS streaming off clears it as well, because there is no TS-HLS output left to encrypt

A new video plays but an old one is unchanged

That is expected. The old video was packaged before the setting changed; re-run its conversion to produce encrypted output.

Need Help?

If you have trouble enabling encryption or playing an encrypted video, contact our support team through the contact form.

Related Articles

• How to Secure Your Videos on DynTube
• Video Playback Issues
• How to Add Login Protection to Videos