9 Security Notes on SDK Encryption Strings and User Configuration Information

It is Not Recommended to Encrypt Sensitive Configurations and Write Them into the SDK

It is not recommended to encrypt userid, writetoken, readtoken, or secretKey and distribute them along with the App or SDK. It is also not recommended to decrypt them on the client side and then pass them through the SDK configuration interface.

Even if the client stores ciphertext, as long as the ciphertext, decryption logic, or key exist simultaneously within the App, they can still be obtained through reverse engineering analysis. Therefore, client-side encryption cannot replace server-side key management.

Among these, secretKey is used for server-side request signing and must only be stored in the business server's environment variables, configuration center, or key management service. It must not be written into the App, SDK configuration, installation package, or client interface responses.

Recommended Approach: Create PlaySafe Token by the Business Server

It is recommended that the business server complete the following process:

1. The App submits the video vid and necessary identity information to the business server to request playback authorization.
2. After verifying the login status and viewing permissions, the business server uses the server-side stored secretKey to create a PlaySafe token.
3. The business server returns the PlaySafe token to the App.
4. The App only passes the obtained token to the player to play the encrypted video, without saving or using sensitive configurations such as secretKey, readtoken, or writetoken.

It is recommended to configure an IP whitelist in the VOD management backend for the server that creates the token, allowing only the fixed outbound IP of the business server to call the token creation interface. For the complete process, please refer to Copyright Protection Best Practices.

How to Handle Applications That Have Already Used SDK Encryption Strings

For applications that have already used SDK encryption strings or client-side decryption solutions, it is recommended to gradually migrate to the server-side PlaySafe token creation approach. During the migration period, adding or spreading sensitive configurations such as secretKey to the client should still be avoided.