--- name: azion-install-the-secure-token-integration description: >- Install Secure Token from Azion Marketplace and run it on a firewall, so only requests with a valid, unexpired token reach your content. --- # Install the Secure Token integration You install the Secure Token integration from Azion Marketplace and run it on a [Firewall](/en/documentation/platform/firewall/), from Azion Console. Secure Token protects your content with token-based, time-limited URLs. You can use the tokens to create and validate signatures for cookies, authentication headers, and other security measures. A common use is to protect video assets for live streaming and on-demand content, delivered through HLS or Progressive Download. Five objects have to exist before a token is checked: the installed function, a firewall carrying the **Functions** module, a function instance holding the arguments, a Rules Engine rule with the **Run Function** behavior, and a workload deployment bound to the firewall. Each section below creates one of them. --- ## Prerequisites - An Azion account. To sign in, refer to [How to access Azion Console](/en/documentation/guides/platform/account-and-billing/how-to-access-azion-console/). - An application served by a [workload](/en/documentation/platform/workloads/), whose deployment you bind to the firewall in the last section. - A way to generate tokens: the example scripts in Azion's Secure Token repository, or your own code. The next sections show how. - The [Azion CLI](/en/documentation/devtools/cli/) installed and authorized, for the last section. - Turning on a product or a module can generate usage costs. For more information, refer to [Pricing](/en/documentation/fundamentals/pricing/). --- ## Install the integration The function is installed once per account. To install it: 1. **Open Marketplace** Access [Azion Console](https://console.azion.com/) > **Marketplace**. 2. **Find the integration** Enter `Secure Token` in the **Search on Marketplace** field, then select the integration's card. Browsing the cards and the categories reaches the same page. 3. **Select Install** The card shows `Successfully installed!` and `Latest version installed!`, and the function appears in the **Function** list of the **Create Instance** drawer. --- ## Generate the token The function validates tokens that you generate with a secret of your choice. You generate them outside Azion, then add them to the URLs you share. To generate a token: 1. **Open the Secure Token repository** Go to [Azion's Secure Token GitHub repository](https://github.com/aziontech/azion_secure_token). The repository explains how the token is generated and how to use it, and holds code snippet examples. 2. **Run an example script** The repository has two example scripts that generate tokens: a `Python` script and a `PHP` script. Run one of them locally, or generate the tokens on your own platform with your own code. 3. **Save the token** Store the generated token, whichever way you generated it. The Python script has this source code: ```python #!/usr/bin/env python import base64 import hashlib secret = 'mysecret' uri = '/my/uri' expire = '1470055000' md5 = hashlib.md5() md5.update(secret + uri + expire) token = base64.b64encode(md5.digest()).replace('=','').replace('+','-').replace('/','_') print 'http://www.example.org%s?st=%s&e=%s' % (uri, token, expire) ``` | Variable | Description | | -------- | ------------------------------------------------ | | `secret` | A string of your choice that generates the token | | `uri` | The URI that uses the token | | `expire` | The expiration time of the token | Keep the `secret` value. The function instance takes it as an argument. --- ## Create the firewall The firewall is where the function is instanced and where the rule that runs it lives. To create one: 1. **Open the Firewalls page** Access [Azion Console](https://console.azion.com/) > **Firewalls**, then create a firewall. 2. **Name the firewall** In the **General** section, enter a **Name**. For example: `secure-token-firewall`. 3. **Turn on the Functions module** In the **Modules** section, turn on the **Functions** switch. 4. **Save the firewall** The firewall shows a **Functions Instances** tab while the **Functions** module stays on. To use an existing firewall instead, turn on its **Functions** module and save it. For every setting on this form, refer to [Set a firewall's main settings](/en/documentation/guides/application-security/firewall-and-waf/firewall-configure-main-settings/). --- ## Create the function instance The instance holds the secret the function uses to validate each token. To create it: 1. **Open the Functions Instances tab** In **Firewalls**, select your firewall, then select the **Functions Instances** tab. 2. **Select + Function** A firewall that has no instance shows the same action as **Function Instance**. The **Create Instance** drawer opens. 3. **Name the instance** In **Name**, enter a name. For example: `secure-token`. 4. **Select the installed function** In **Function**, select the Secure Token function. The list holds only the functions that run on a firewall. 5. **Enter the arguments** In **Arguments**, the editor is prefilled with the integration's default arguments in JSON. Enter your secret, as the next section describes. 6. **Select Save** The instance is listed in the **Functions Instances** tab. ### Arguments The instance takes one argument: ```json { "secure_token_secret": "thatisthesecret" } ``` | Variable | Description | | --------------------- | --------------------------------------------------------------------- | | `secure_token_secret` | The secret string you passed in the code when you generated the token | --- ## Create the rule The instance checks nothing until a rule runs it. A [Rules Engine for Firewall](/en/documentation/platform/firewall/rules-engine/) rule selects the requests that reach the instance, through a **Run Function** behavior. To create the rule: 1. **Open the Rules Engine tab** In **Firewalls**, select your firewall, then select the **Rules Engine** tab. 2. **Select + Rule** 3. **Name the rule** In **Name**, enter a name. For example: `Run Secure Token`. 4. **Set the criterion** In the **Criteria** section, select the domains that run the integration. For example: if `Host` *matches* `yourdomain.com`. 5. **Add the Run Function behavior** In the **Behaviors** section, select **Run Function**, then select the instance by the name you gave it. 6. **Select Save** The firewall runs the instance on every request to the domain in the criterion. --- ## Bind the firewall to the workload The binding is on the workload's deployment, so create a deployment that names both the application and the firewall: ```bash azion create workload-deployment --workload-id --name \ --application-id --firewall-id --strategy-type default \ --active true --current true ``` The command prints the id of the new deployment: ```text Created Workload Deployment with ID 123456 ``` Requests to the workload's domain reach the firewall, and the rule runs the Secure Token instance on each one. --- ## How it works The function performs two checks on each token: whether the current time is greater than the expiration time in the token, and whether the signature matches the token signature. - If the signature is invalid, the function returns a `403` error. - If the expiration time is exceeded, the function returns a `410` error. A user cannot change the expiration time of a token without breaking its signature. --- ## Next steps - [Marketplace integrations](/en/documentation/platform/marketplace/integrations.md): Every integration Azion Marketplace offers, and where each one runs. - [Rules Engine for Firewall](/en/documentation/platform/firewall/rules-engine.md): Every criterion and behavior a firewall rule accepts. - [Update an integration](/en/documentation/guides/application-development/integrations/update-an-integration.md): Move an installed integration to its latest version.