Skip to content

Protect playback

A channel that plays for anyone who has the URL is a channel anyone can watch for free — or restream and resell. Auth & DRM in the sidebar is where you decide who may play. One policy covers the whole installation; every streamer enforces it.

Two ways to authorize a viewer

Catena can decide whether to admit a viewer in one of two ways. They can run side by side, and you can move from one to the other at your own pace — but for anything new, use tickets.

  • Catena tickets — the recommended way. Your storefront creates the viewer's session ahead of time and hands them a ticket; the streamer admits it on its own, with no call to your systems while the viewer watches. Playback stops depending on your storefront being fast, or even up — and channels start and switch instantly. This is the path Catena is built around; set it up with your developers from Catena tickets.
  • Your existing authorization backend. If you already run middleware that says yes or no per viewer — especially one written for Flussonic — you can plug it in unchanged and migrate later. The trade is that playback waits on your backend. Connect it from flussonic authorization.

For the simplest case — a channel you just need closed, with no system to run — a shared token and IP lists lock it from this screen alone: a play token the player must present, and allow/deny lists checked before any backend. Deny always beats allow.

The Auth & DRM section

Opening a channel to everyone

Authorization is an allow-list, and that is deliberate: a viewer who matches no allow rule and whom no backend approves is refused. You open access on purpose — so a channel is never left exposed because someone forgot a rule. It is opt-out by design, not opt-in: the safe state is the default, and turning protection off is the explicit act. You never have to lock a fresh install by hand: until a policy is configured, the cluster already refuses playback — access is something you open on purpose.

So if a channel really is meant for the whole world, open it deliberately: turn on the Let everyone play toggle in Auth & DRM. It is a single switch that admits any viewer with no token — IPv4 and IPv6 alike (a bare 0.0.0.0/0 in Allow IPs would cover only IPv4). Authorization is then effectively off for everything this policy covers. Use it only for genuinely public content; a token or IP range you actually control is the safer way to widen access.

Who is watching right now

The Sessions screen lists every viewer currently playing — the channel, where they are, and how long they have been watching — whichever way they were authorized. A viewer you do not recognize can be closed from here on the spot, and the streamer drops them within seconds.

Live viewers on the Sessions screen

History

When a session ends it moves to the history: who watched what, from when to when, and why it closed. This is where you look to see that a revoked ticket really did drop its viewer, or to account for a channel's audience over a shift.

Playback history

Next steps