How to Secure HLS Video Streams Using JWT-Signed URLs with Express 5

A developer tutorial published on DEV Community demonstrates how to prevent unauthorized access to paywalled HLS video streams, which are vulnerable because their .m3u8 playlist URLs can be shared and replayed without authentication. The guide uses an Express 5 gateway to issue short-lived JSON Web Tokens (JWTs) that are validated on both the master manifest and every individual video segment. A key technique involves rewriting the playlist so that the token is automatically appended to each segment URL, eliminating the need for the client player to handle token propagation manually. The tutorial also addresses a common implementation bug where tokens expire mid-playback, and recommends a clock tolerance setting to handle client-server time skew. The accompanying code, built on Node 24.x with the jsonwebtoken library, is shared publicly on GitHub as a reference implementation.