A cached object is still a public object if the URL is enough. Paid installers, embargoed video and pre-load game depots need a token at the edge so unauthorised clients never reach cache or origin.
Gate the hit
Cloud CDN checks the token before serving from cache. Origin is not bothered by unauthorised GETs. Authorised users still hit 210+ PoPs.
Expiry matches the product
Rental windows, pre-load windows and one-time downloads need different lifetimes. Short expiry limits leaked URL reuse.
Public and private on one distribution
Marketing pages stay public. /downloads and /hls paths require tokens. Path policy, not a second CDN.
Not a replacement for login
The application still mints the URL after it checks entitlements. The CDN enforces the URL. Billing stays in the app.