Livraison signée (voie rapide)

https://1bb2f0c4-....audiodelivery.net/7e4386f0-..../20260709145408659.uSYrzmRWTDvEyjFz_lq.aac

function base64url(bytes) {
  let binary = '';
  const b = new Uint8Array(bytes);
  for (let i = 0; i < b.byteLength; i++) binary += String.fromCharCode(b[i]);
  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
}

async function hmacSha256(key, data) {
  const cryptoKey = await crypto.subtle.importKey(
    'raw', new TextEncoder().encode(key),
    { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']
  );
  return new Uint8Array(await crypto.subtle.sign('HMAC', cryptoKey, new TextEncoder().encode(data)));
}

// secret = the URL Signing key secret from the dashboard (keep this server-side)
// domain = your org delivery host, e.g. "1bb2....audiodelivery.net"
// path   = the file path, e.g. "folder-id/track-index_lq.mp3"
async function signUrl(secret, domain, path) {
  const u = new URL('https://' + domain + '/' + path);
  u.searchParams.delete('verify');

  const message = u.pathname + (u.search || '');
  const issued = Math.floor(Date.now() / 1000).toString();

  const mac = await hmacSha256(secret, message + issued);
  u.searchParams.append('verify', issued + '-' + base64url(mac)); // verify MUST be last

  return u.toString();
}

// Express example: hand a freshly signed URL to your frontend.
app.get('/api/track-url', async (req, res) => {
  const url = await signUrl(
    process.env.ADN_SIGNING_SECRET,      // never expose this to the client
    process.env.ADN_DELIVERY_DOMAIN,     // e.g. 1bb2....audiodelivery.net
    req.query.path                       // folder-id/track-index_lq.mp3
  );
  res.json({ url });
});

<!-- The signed URL works anywhere a normal audio URL does. -->
<audio controls src="https://{org}.audiodelivery.net/{file_path}?verify={issued}-{mac}">
</audio>