CDN token authentication
A cached object can still be gated.
Once a private URL is cached, anyone with the link can reuse it. Paid downloads, pre-load game depots and embargoed video need a token at the edge.
Cloud CDN supports secure token authentication. The edge checks the token before serving from cache. Origin never sees the unauthorised request.
Why teams use Aptranet
What CDN token authentication looks like on this network.
Cloud CDN caches and accelerates eligible content on 210+ points of presence, with Origin Shield when the origin must stay out of the way.
Gate cache hits
Unauthorised clients are rejected at the edge, even when the object is already cached.
Paid and pre-release artefacts
Software, game and video URLs can expire or require a signature.
Still a global cache
Authorised users still hit 210+ PoPs. The token is the difference.
How to set it up
A cutover you can validate before DNS moves.
Create the Cloud CDN configuration, prove it on an Aptranet hostname, then point production DNS when the path looks correct.
- 1Identify paths that must not be public
Downloads, media or API GETs that require a login or purchase.
- 2Enable token authentication on those paths
Leave marketing pages public.
- 3Issue tokens from the application
Your origin or auth service mints the URL the client will request.
- 4Set expiry to match the product
Pre-load windows, rental windows and one-time downloads differ.
Outcomes
What changes once the hostname is on Aptranet.
- Private objects are not anonymously shareable
- Authorised hits still come from cache
- Public pages can share the distribution
- Origin is not bothered by unauthorised GETs
Keep reading
Related pages
More CDN use cases on the same Cloud CDN footprint.
Frequently Asked Questions
Token authentication is enforced at Cloud CDN. You can still validate at origin; the edge rejects bad tokens first.
Yes. Segment URLs can require a token so playlists are not freely redistributed.
Short expiry limits reuse. Rotate secrets and purge if a long-lived token was exposed.
No. It protects CDN URLs. Account login, entitlements and billing stay in the application.