Visibility and sharing

Visibility controls where a video can be found and who can load its share or embed URL.

Domain restrictions are separate from visibility. See Where your videos can play to control which websites may load a published player.

Public

Public videos receive a share page and embed. Without a password, anyone with the URL can watch.

Unlisted

Unlisted videos are not presented as public listings. Without a password, anyone with the share or embed URL can watch.

Private

Private videos are withheld from public share, embed, oEmbed, and analytics-grant routes. They remain available through authenticated workspace playback. Password protection does not grant access to a private video.

Password-protected links

When enabled for your workspace, use Password protection in the video's Visibility panel or Share & Embed dialog. Set a password on a public or unlisted video, replace it with a new password, or choose Remove password. Passwords are never shown again or returned by the API.

Viewers see a workspace-branded password form with the title and poster. Protected public pages and static manifests contain no playback source. After a correct password, Playflow sets a signed, video-scoped, HttpOnly secure cookie on the application origin for 24 hours. Only then does the player fetch the playback manifest. Ten unlock attempts per IP and video per minute are allowed; wrong passwords and unavailable videos return the same error.

Embedded players require third-party cookies. If the browser blocks the unlock cookie, the player explains the restriction and offers the watch page. Browser privacy settings can also restrict cookies on the watch page. There is no bearer-token or URL-password fallback.

Changing or removing a password revokes previous unlocks. Making the video private also revokes unlocks. Password transitions remove and verify old public objects before saving, then republish the share page and embed. Removing protection restores ordinary publication. If edge deletion or cache verification fails, saving fails rather than claiming the video is protected. Previously delivered playback URLs cannot be recalled; a viewer who already received a signed source may retain it until it expires.

Changing visibility

Visibility changes are audited and published asynchronously. The share panel shows publishing, live, update pending, failed, or not published edge status.

Download the original file

Original-file download is a Fleet capability and also requires video-download permission. Use the authenticated video action or POST /api/v1/videos/:id/download with an eligible API key. The response is a short-lived private download link and an expiration time, not a permanent public source URL.

The download checks the current workspace, permission and original-file availability again. A playable stream does not guarantee that a retained original is available. An expired link must be requested again. Do not expose a download ticket in a public embed or treat it as a replacement for the watch link. For a whole-workspace ZIP, see Workspace exports.

Watch-page metadata

Public watch pages include the video's title and metadata for sharing and search. Unlisted and private visibility are not interchangeable: an unlisted link can still be shared by anyone who has it, while a private video is not publicly watchable. Choose visibility before distributing a link; metadata is not an access-control mechanism.