Flussonic Token Authentication

When a stream’s source is a Flussonic server, XUI.live can hand each viewer a signed, expiring token instead of the bare source URL. The token proves the viewer is a paying subscriber, ties the session to their account and connection limit, and can pin it to their IP — so a URL copied out of a playlist is worthless to anyone else within minutes.

This is for direct-source streams: the ones your servers do not ingest, where the player talks to the Flussonic origin. Token authentication is what lets you deliver those directly without exposing an open URL.

How it works

When a subscriber requests a Flussonic-backed direct stream, XUI.live:

1. Builds a token that encodes when it expires, the stream, the subscriber’s account and connection limit, and optionally their IP address.
2. Signs it with HMAC-SHA256 using a secret shared with your Flussonic server.
3. Redirects the player to the real source URL with ?token=… appended.

Flussonic then calls back to XUI.live to verify the token before it serves a single segment. A valid, unexpired, correctly-signed token gets OK; anything else gets 403 Forbidden. The subscriber never sees the raw source, and the token stops working the moment it expires.

Enable it on a stream

Token auth is a per-stream option, on the stream editor’s Advanced tab. It appears only when the stream is set up for it — all three must be true:

• Flussonic Auth — the switch itself, on.
• Direct source — on. Token auth applies to sources the player reaches directly.
• Direct proxy — off. If you are relaying the source through your own server, there is no direct URL to protect and the option does not apply.

With those set, every request to this stream is redirected to the Flussonic origin with a fresh token.

IP lock

IP Lock, beside the Flussonic switch, binds each token to the address that requested it. Flussonic then refuses the token from any other IP — a link shared to a second household simply returns 403. Leave it off for subscribers who roam between networks; turn it on where a stream is valuable enough to defend hard. (IP lock requires direct proxy to be off, which token auth already requires.)

Token lifetimes

Two lifetimes govern how long a signed URL stays valid, tuned to the trade-off between security and re-signing overhead:

• Client token — the viewer-facing token, short by design (a couple of hours by default). Short lifetimes mean a leaked URL dies quickly; the player re-requests and gets a fresh one transparently.
• Server token — used for XUI.live’s own server-to-server calls to Flussonic, longer-lived (up to a week).

The defaults suit most operations. Shorten the client token where you want leaked links to expire faster.

The validation endpoint

Flussonic verifies each token against XUI.live at a fixed backend URL:

http://<your-panel-ip>/backend/flussonic_auth

Replace <your-panel-ip> with your panel’s address or domain, on its broadcast port (port 80 by default, or your HTTPS port over https://). This is the URL you give Flussonic as its authentication backend — point the origin’s on_play handler at it (and on_publish as well if the same origin ingests):

# In the Flussonic stream or config, e.g.
on_play http://<your-panel-ip>/backend/flussonic_auth;

The contract is exactly what a Flussonic auth backend expects:

Nothing else needs to be built on the Flussonic side: it calls this URL on every play, and XUI.live’s answer decides whether a segment is served.

The shared secret

Token signing and validation both rely on a secret shared between XUI.live and your Flussonic server. It is provisioned as part of your installation — you do not paste it into the panel, and it is never shown in a URL or a playlist. If you operate your own Flussonic origin and need the integration configured, contact support with your setup and we will align both ends.

When to use it

Reach for Flussonic token auth when you deliver direct sources from a Flussonic origin and want subscriber-grade protection on them — per-account, time-limited, optionally IP-locked — without routing the traffic through your own servers. For sources you ingest, the panel’s normal line restrictions and stream token protection already apply; this fills the gap for the direct path.