Video Delivery

What it is

Video Delivery stores the file you PUT and plays those bytes. Playback links can expire. The file is AES-256-GCM. Zipper does not encode, transcode, watermark, or build adaptive HLS.

Cloudflare analogue: Cloudflare Stream (storage + play — not encode). SLA 99.9% · p99 80ms. Operators ingest video. Admins set signed playback.

• ▸Encrypted files
• ▸Signed playback links
• ▸Crown cache
• ▸No transcode

How it works

PUT a file; Zipper wraps it in AES-256-GCM before it is stored. Playback URLs are HMAC-sealed. There is no HLS ladder and no transcode.

Signed playback keeps paid videos off anonymous GETs.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Services → Video Delivery. Ingest a title, PUT the object, optionally require signed playback.

API

Control-plane: GET|POST /api/v1/video. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

curl -sS -X POST https://tinyzipper.com/api/v1/video \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"name":"Product tour","duration_seconds":180}'

const res = await fetch("https://tinyzipper.com/api/v1/video", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

Take-down: purge via The Archives using the playback prefix.

• ▸SOC 2
• ▸HMAC playback
• ▸AES-256-GCM

Runbook

Play files at /_video. Signed playback is required. Objects are AES-256-GCM in object storage. Do not encode or emit HLS.