---
title: "Create or update media-auth policy"
method: POST
path: "/policies/{code}"
tags: ["policies"]
---

# Create or update media-auth policy

`POST /policies/{code}`

## Path parameters

- `code` string, required

## Request body

- DomainPolicy
  - `allow_countries` string[]
  - `allow_ips` string[] — Static allow/deny chain. IPs accept exact addresses or CIDR ranges; Countries are ISO 3166-1 alpha-2 codes (need a GeoIP DB — see SessionsConfig.GeoIPDBPath); UserAgents match case-insensitive substring; AllowedDomains match the Referer host (exact or parent domain).
  - `allow_user_agents` string[]
  - `allowed_domains` string[]
  - `code` string — Code is the unique key chosen by the operator.
  - `deny_countries` string[]
  - `deny_ips` string[]
  - `deny_user_agents` string[]
  - `description` string
  - `name` string — Name and Description are operator-facing metadata.
  - `require_token` boolean — RequireToken makes a valid signed playback token mandatory. The server only VERIFIES tokens; clients mint them with TokenSecret — see internal/mediaauth.SignToken for the canonical token format.
  - `token_secret` string — TokenSecret is this policy's HMAC-SHA256 verification key. Required when RequireToken is true. Each policy owns its own secret so revoking one policy's key never affects another.

## Response `200`

OK

- object

## Other responses

- `201` — Created
- `400` — Bad Request
- `500` — Internal Server Error

---

[API](https://skmtc.net/datvietvac-techhub/apis/open-streamer-api.md) · [All operations](https://skmtc.net/datvietvac-techhub/apis/open-streamer-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datvietvac-techhub/open-streamer-api/revisions/9f723293b698/schema)