Cloudflare Stream Video setup and Security

Basketball IQ Lab™ Cloudflare Video Library, Paid Playback, Storage and Security — Coder Implementation Specification Version: September 16, 2026 Project: Basketball IQ Lab™ Purpose: Secure paid video library using Cloudflare Stream, Cloudflare R2, Supabase, and Stripe. 1. Architecture Decision Use the following division of responsibility: System Responsibility Cloudflare Stream Encoding, adaptive streaming, playback, signed video access, allowed-origin restrictions, thumbnails, video processing Cloudflare R2 Private storage of original/master media files and archival assets Supabase Users, products, video catalog metadata, access entitlements, viewing records, progress, authorization Stripe Membership billing, one-time purchases, PPV purchases, renewals, refunds, payment status Basketball IQ Lab web app UI, authentication, catalog, checkout initiation, authorization requests, player page Important Corrections Cloudflare Stream does not charge the viewer. Cloudflare bills Basketball IQ Lab for Stream storage and delivery. Stripe or another payment provider must charge the customer. R2 is not required for Stream playback. Stream can ingest and host playable videos itself. R2 is recommended here as the private master/archive layer. Do not serve paid videos directly from R2. Paid playback should use Cloudflare Stream. The R2 master bucket should remain private. Do not use the public Stream video UID as authorization. Paid videos must have requireSignedURLs = true. The application must issue a short-lived signed token only after verifying user entitlement. Do not trust the browser to determine whether a customer paid. Entitlements are created or revoked server-side based on verified Stripe webhook events. Allowed Origins are not a substitute for signed URLs. Use both. Allowed Origins limits where playback can occur; signed tokens limit who may receive access. Do not make permanent playback URLs. Store the Stream UID in the database. Generate temporary playback tokens on demand. 2. Cloudflare Account Setup 2.1 Enable Cloudflare Stream In the Cloudflare dashboard: Open Stream. Activate Stream billing. Upload one internal test video. Confirm processing completes successfully. Record: Cloudflare Account ID Stream customer code Test Stream video UID Do not put any Cloudflare administrative API token in client-side JavaScript. 3. Cloudflare API Token Create a dedicated API token for the production backend. Use the least permissions necessary for: Stream read/write management needed by the application Stream video upload/update as required Stream token generation if using the API approach R2 access only if the same backend must access R2 Prefer separate tokens for Stream and R2. Store secrets only in the server/edge environment: CLOUDFLARE_ACCOUNT_ID= CLOUDFLARE_STREAM_API_TOKEN= CLOUDFLARE_STREAM_CUSTOMER_CODE= CLOUDFLARE_STREAM_SIGNING_KEY_ID= CLOUDFLARE_STREAM_SIGNING_PRIVATE_KEY= If Cloudflare Workers Stream bindings are used, the implementation can generate signed tokens with the binding instead of maintaining a signing key. 4. Cloudflare Stream Security Defaults Every premium/member video must use: requireSignedURLs = true Also set allowed playback origins. Initial production list should include only actual Basketball IQ Lab application domains, for example: basketballiqlab.com www.basketballiqlab.com Add staging domains separately. Do not use unrestricted wildcard origins in production. Cloudflare notes that: Stream videos are otherwise viewable by anyone who knows the video ID. requireSignedURLs prevents playback using only the UID. Allowed Origins restrict the domains from which HLS/DASH playback requests may originate. Signed tokens and embedding restrictions can be combined. Reference: https://developers.cloudflare.com/stream/viewing-videos/securing-your-stream/ 5. Signed Playback Token Design Recommended production flow