Secure video player for Node.js and Express
Running your course site on Node.js? Fetch a token in the lesson route and show the secure player to the signed-in user.
Why XAPlayer for Node.js
No library needed
Node’s built-in fetch is enough, from version 18.
Key stays on the server
The API key lives in an environment variable and never ships in a browser bundle.
User name on the video
The name and phone you send from the user’s session become the watermark.
Download protection
Lessons stream encrypted; downloaders get nothing playable.
Three steps to secure playback
- Put the API key in XAPLAYER_API_KEY.
- In the lesson route, after the access check, fetch a token.
- Put the player URL in an iframe in your template.
Tutorials and docs
A taste of the code
The full code, where it goes and how to test it are in the tutorial.
const res = await fetch('https://en.xaplayer.ir/api/v1/embed-tokens', {
method: 'POST',
headers: {
Authorization: `Bearer ${process.env.XAPLAYER_API_KEY}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({ courseId: 'COURSE_ID', viewer: { id: user.id, name: user.name } }),
});
const { url } = await res.json(); // put it in an <iframe>
Questions
Yes. The same fetch works in any Node.js framework.
18 or newer for built-in fetch; on older versions use undici or axios.
No. Fetch a fresh one each time the page opens for a user, so their own name is on the video.
Send videoId instead of courseId.
Other platforms
Protect your course today
Signing up takes two minutes. 14 days free, with 10 licenses on us.
Start your 14-day free trial