How to Set Team-Wide Access Rules

The Access Rules page lets you set default restrictions that apply to every video on your team. You can require a password, enforce signed URLs, limit embeds to specific domains, block or allow countries, and restrict by IP range.

Open Access Rules

In the sidebar, click Access Rules.

Set visibility

At the top of the page, the Visibility toggle controls whether your videos are publicly accessible or restricted.

• When the toggle is on (public), all videos are accessible to anyone with the link.
• Turn the toggle off to enable the restriction rules below.

All other settings on this page only take effect when visibility is set to restricted.

Require a password

Enter a password in the Password field. Viewers will be prompted to enter this password before the video plays. To remove password protection, click Clear.

Require signed URLs

Toggle on Signed URLs to require all video URLs to carry a valid HMAC-SHA256 signature. Unsigned requests will be rejected.

When enabled, your Signing Secret is displayed (hidden by default). Click Show to reveal it, Copy to copy it to your clipboard, or Rotate to generate a new secret. Rotating invalidates all previously signed URLs immediately.

To generate a valid signature, construct the message as videoId + '\n' + expiry, sign it with HMAC-SHA256 using your secret, encode the result as a hex string, and append ?sig=<hex>&exp=<expiry> to the embed or CDN URL.

Restrict embedding by domain

Under Domain Allowlist, enter a domain (e.g. example.com) and click Add or press Enter. Only pages served from listed domains will be allowed to embed your videos. Add as many domains as needed; click the × next to any domain to remove it.

Restrict by country

Under Country Restrictions, choose a mode from the dropdown:

• Allow only — access is permitted only from the listed countries.
• Deny — access is blocked for the listed countries; all others are allowed.

Enter a two-letter ISO country code (e.g. US, DE) and click Add. Click × to remove a country.

Restrict by IP address

Under IP Allowlist, enter an IP address or CIDR range (e.g. 10.0.0.0/8, 203.0.113.42) and click Add. Only requests from the listed addresses or ranges will be allowed through.

Save your changes

Click Save at the bottom of the page. All rules are saved together in a single action.

If any individual videos have custom rules that differ from the team defaults you just saved, a dialog will appear listing the affected rule types and how many videos are overriding each one. Click Update all next to a rule type to sync those videos to the new team default, or Leave as-is to keep the video-level overrides in place.