Video paywall
A video paywall is access control that refuses to play a video until the viewer has the right entitlement: a purchase, an active subscription or an enrolment. A paywall holds only when it is enforced at playback, not just on the page. Your backend checks the viewer's rights and hands the player a signed token that expires quickly, and the video platform refuses any request without one. Premium titles add DRM on top. Many paywalls leave a free preview in front of the gate.
How does a video paywall work?
A video paywall has two halves that run on different systems. The first is the entitlement check, which lives in your backend. When a viewer opens a video, your app asks the server whether this account has bought, subscribed to or enrolled in it. Billing and accounts stay in your own systems.
The second half is playback enforcement. If the check passes, the backend signs a token, often a JWT (JSON Web Token) carrying the video ID and an expiry. The player attaches it to its first request, for the manifest, which is the index of the stream's segments. The video platform verifies the signature and refuses requests without a valid token. If the check fails, the app shows a preview or a sign-in prompt instead. Because the token is signed with a key only your backend holds, a viewer cannot forge one or stretch its expiry.
Why do video paywalls leak?
Most leaking paywalls were never broken. They were built as a page gate: a login screen or overlay in front of a player that streams from a public URL. Anyone who opens the browser's network panel can copy the manifest URL and play it elsewhere, and download tools can save every segment.
Other leaks are subtler. Tokens with long expiry, such as a week, turn into shareable links. Signing the manifest but not the segments lets someone who saved the manifest once keep fetching the video. A free preview built by stopping the player after a minute still streams the full video to anyone who reads the manifest directly. Course platforms see this as a whole module pasted into a student group chat.
The fix in each case is the same: every request the player makes must carry proof of entitlement that expires quickly.
Video paywall vs. DRM: which do you need?
They answer different questions. A paywall decides who may start playback. DRM decides what can be done with the video once it is playing. A paywall built on signed, expiring tokens stops link sharing, but a viewer who passed the check can still record the segments with a stream-ripping tool, because the segments are either clear or protected with a key the player can read.
DRM encrypts the segments so that only a secure module inside the device can decrypt them, under rules carried in a license. It costs more to run: a license request on every play, license servers per DRM system and testing on every device.
Most services layer the two. Every private video sits behind signed tokens. Titles with licensing terms or high value, such as new episodes or flagship courses, also get DRM. Free trailers stay public.
How do you build a free preview in front of a video paywall?
A preview must be a separate thing to stream, not a player that stops early. There are three common patterns. The first is a separate preview asset: a trailer or a clip cut from the full video, on its own public playback ID. The second is episode gating, where the first episodes of a series are public and later ones need a token, which is how vertical microdrama feeds work. The third is a time-limited token for the full video, which suits a trial day rather than a teaser.
The preview is also the place to measure. Pass the viewer ID and the viewer's plan into your analytics, and compare how far free viewers get before they leave. If most leave before the gate, the preview starts too slowly or runs too long.
How does FastPix handle video paywalls?
FastPix enforces the paywall at playback, while your billing and entitlement service decide who has paid. Every playback ID is public or signed. For signed IDs, your backend issues a JWT with FastPix signing keys and an expiry you choose, and FastPix plays the video only while that token is valid.
Previews map to the same model. Trailers and free episodes can run on public playback IDs, and a teaser can be cut from any video as a clip. The FastPix Player supports vertical 9:16 playback with swipe-to-next and tier-gating, so a feed can stop after a set number of episodes and ask for payment. Keep the gated episodes on signed playback IDs so the gate holds outside the player too. Premium titles can add Widevine, FairPlay and PlayReady DRM through the DRM API, and the player can show a configurable visible watermark. On live classes and events, the playback policy on the stream carries to the archived replay. On WordPress, including course sites on LearnDash, TutorLMS and LifterLMS, the ready-made FastPix WordPress plugin gates videos with signed links that last from 2 minutes to 24 hours, 15 minutes by default, with DRM when needed and a watermark at upload.
Video Data takes your viewer ID and up to 10 custom dimensions, such as plan, and records the farthest playhead position per view, which shows where free viewers stop.
Standard encoding is free up to 4K, storage is billed per rendition-minute and streaming per minute watched. DRM, where used, is a monthly platform fee plus a small fee per license. The free plan, with no card, covers 10 videos and 100,000 streaming minutes a month, enough to test a paywall with an expired token.
