import jwt from "jsonwebtoken";

const privateKey = Buffer.from(
  process.env.ANTCDN_PRIVATE_KEY!,
  "base64" // If you saved your private key as base64, you need to do this. If it's just a string, omit this.
);

// The issuer you specified when creating your signing key
const ISSUER = process.env.ANTCDN_ISSUER || "my-company.com";

function signPlaybackToken(
  // Edge Key you want to allow
  // Pass "*" to allow all private Edge Keys
  edgeKey: string,
  // The ID of the key you generated in step 1.
  keyID: string,
  expiresInSeconds: number
): string {
  return jwt.sign(
    {
      sub: edgeKey,
      iss: ISSUER,  // Must match the issuer you set when creating the key
      aud: edgeKey
    },
    privateKey,
    {
      algorithm: "RS256",
      expiresIn: expiresInSeconds,
      keyid: keyID
    }
  );
}

import base64
import os
from datetime import datetime, timedelta, timezone

import jwt  # PyJWT

PRIVATE_KEY = base64.b64decode(os.environ["ANTCDN_PRIVATE_KEY"])
KEY_ID = os.environ["ANTCDN_KEY_ID"]
ISSUER = os.environ.get("ANTCDN_ISSUER", "my-company.com")  # Your issuer

def sign_playback_token(edge_key: str, expires_in_seconds: int) -> str:
    """
    edge_key: Private Edge Key the viewer may access. Pass "*" to allow all private Edge Keys
    expires_in_seconds: Lifetime of the token in seconds.
    """
    payload = {
        "sub": edge_key,
        "iss": ISSUER,  # Must match the issuer you set when creating the key
        "aud": edge_key,
        "exp": datetime.now(timezone.utc) + timedelta(seconds=expires_in_seconds)
    }

    headers = {"kid": KEY_ID}  # Signing key ID from the Antcdn dashboard

    return jwt.encode(payload, PRIVATE_KEY, algorithm="RS256", headers=headers)


token = sign_playback_token("edge_PRIVATE_123", 15 * 60)
print(token)

package main

import (
    "encoding/base64"
    "log"
    "os"
    "time"

    "github.com/golang-jwt/jwt/v5"
)

// Helper function to sign a private Edge Key (or "*" for all videos)
func signPlaybackToken(
  // Edge Key of the video you want to allow
  // Pass "*" to allow all private Edge Keys
  edgeKey string,
  // The ID of the key you generated in step 1.
  keyID string,
  expiresIn time.Duration
  ) (string, error) {
    // edgeKey: private Edge Key the viewer may access
    // keyID: signing key ID from the Antcdn dashboard
    // expiresIn: lifetime of the token

    keyBytes, err := base64.StdEncoding.DecodeString(os.Getenv("ANTCDN_PRIVATE_KEY"))
    if err != nil {
        return "", err
    }

    privateKey, err := jwt.ParseRSAPrivateKeyFromPEM(keyBytes)
    if err != nil {
        return "", err
    }

    claims := jwt.MapClaims{
        "sub": edgeKey,
        "iss": os.Getenv("ANTCDN_ISSUER"),  // Must match the issuer you set when creating the key
        "aud": edgeKey,
        "exp": jwt.NewNumericDate(time.Now().Add(expiresIn)),
    }

    token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
    token.Header["kid"] = keyID

    return token.SignedString(privateKey)
}

func main() {
    token, err := signPlaybackToken(
        "edge_PRIVATE_123",
        os.Getenv("ANTCDN_KEY_ID"),
        15*time.Minute,
    )
    if err != nil {
        log.Fatal(err)
    }

    log.Println("Signed JWT:", token)
}