I have a video library that I need to publish for my clients. The clients need to be able to embed a player into their sites and play the videos. I need to restrict access to my clients only so that no one else could put videos on their sites or access them programmatically.
To be more clear, I am trying to figure out how to make sure that my videos are used only on the sites of my clients, and not on any unauthorized sites. Say, myclient.com wants to have a video on their site for all their visitors. How would I accomplish this?
This is my understanding so far:
when the client's site is visited, and the page containing the video is requested, the client's server authenticates against my API that serves videos (is a full-scale oauth2 provider adequate here?)
after that, the client's server obtains a one-time token for the specific video, which in addition to being one time, has a very short TTL
Note that the part of the API that starts streaming videos is not protected by the oauth2 mechanism, and only is protected by these one-time tokens.
Would this approach work, or are there better ways to do this?
To simplify my question, I am not asking how to prevent the end user from saving the video on the local machine. I am asking whether it is feasible to prevent a website that is not authorized from embedding the videos on their pages and to make sure that only the sites that are allowed to do so, can do it.