Private secure broadcasting via a link with a key

Important! After saving the secret key, the standard stream link will no longer work without a valid key parameter.
Secure broadcasting prevents direct access to the audio stream and allows listeners to receive temporary links linked to their IP address. This feature is available in PRO packages.

What can this be used for?

Paid subscription. The site verifies payment and opens the stream only to users with a valid subscription.
Closed corporate radio. Access is granted only to employees, partners, or team members.
A closed broadcast or event. The link can be provided to participants of a course, club, conference, or online event.
Temporary guest access. The client or partner receives a link that cannot be used after the expiration date.
Demo listening. The duration parameter limits the duration of a single connection.
Protection is not a payment or authorization system. MyRadio24 verifies the link, and your website decides who to share it with.

How does a secure link work?

Your server creates a signed key for a specific listener and generates a link of the following type:
https://myradio24.org/LOGIN?key=YOUR_KEY

When connecting, MyRadio24 checks the parameters:
Secret key - kept only by the owner of the radio.
IP address - the link only works for the address for which it was created.
expire - the time until which a new connection is allowed to start.
duration - limit on the duration of one connection in seconds.
If the signature is invalid, the IP does not match, or the expire time has already passed, the server rejects the connection.

How to enable secure broadcasting

1. Open the radio control panel.
2. Go to Settings -> PRO Package .
3. Find the PRO Secure Broadcasting block using the link with the key .
4. Enter a secret key between 6 and 30 characters long. Use Latin letters and numbers.
5. Save the settings.
After saving, the panel will display a ready-made link for one hour with no playback time limit. This can be used for a quick test. A regular stream link will no longer play radio after protection is enabled—this is normal operation.

Signed key format and link generation

The key consists of an MD5 signature and an expire value appended to it:
key = md5(SECRET_KEY + IP + expire + duration) + expire

The values are combined without separators and strictly in the specified order.
expire - Unix timestamp in seconds. It is not passed as a separate URL parameter, as it is already appended to the key.
Duration is an integer number of seconds. A value of 0 means no duration limit. Duration is included in the signature. The listener cannot independently change 30 seconds to another value: changing the parameter invalidates the key. If duration is greater than 0, it must be passed in the link:
https://myradio24.org/LOGIN?key=YOUR_KEY&duration=30

A short example of generating a link in PHP :

 <?php
$radio="YOUR_LOGIN_RADIO";
$secret="YOUR SECRET KEY";
$ip=$_SERVER['REMOTE_ADDR'];
$expire=time()+10; //the link is valid for 10 seconds for IP
$duration=30; //the stream plays for 30 seconds (0 - unlimited)
$key=md5($secret.$ip.$expire.$duration).$expire;
$link="https://myradio24.org/$radio?key=$key";
if($duration) $link.="&duration=$duration";
echo $link;

Recommendations for a site with authorization and sample code

In the HTML player, it is better to specify a permanent address to the script of your site example.com , for example like this:

 <audio controls preload="none">
    <source src="https://example.com/listen.php" type="audio/mpeg">
</audio>

The listen.php handler must:
1. Check user authorization.
2. Check your subscription, invitation, or other access rights.
3. Generate a new link for the listener's IP.
4. Redirect the player to MyRadio24 with an HTTP 302 response.

An example of PHP code where you need to check authorization and correctly obtain the listener IP:

 <?php

// Configuration
$baseUrl = 'https://myradio24.org/YOUR_LOGIN';
$secret = 'YOUR_SECRET_KEY';
$ttl = 60; // Seconds to start the thread
$duration = 0; // Duration in seconds (0 = unlimited)
$trustedProxies = ['127.0.0.1', '::1'];

// Access check
session_start();
if (empty($_SESSION['user_id'])) {
	http_response_code(403);
	die('Access denied');
}

// Determining the real IP
function getClientIp($trustedProxies) {
	$ip = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
	if (in_array($ip, $trustedProxies, true) && !empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
		$ip = trim(explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'])[0]);
	}
	return $ip;
}

// Get a secure reference to the stream
function getMyRadio24URL($baseUrl, $secret, $ip, $ttl, $duration=0) {
	$expire = time() + $ttl;
	$key = md5($secret . $ip . $expire . $duration) . $expire;
	$params = ['key' => $key]; 
	if($duration) $params['duration']=$duration;
	return $baseUrl . '?' . http_build_query($params);
}

// Get the real IP and generate a link to the stream
$clientIp = getClientIp($trustedProxies);
$signedUrl = getMyRadio24URL($baseUrl, $secret, $clientIp, $ttl, $duration);

// Redirect the user to the link
header('Cache-Control: private, no-cache');
header('Location: ' . $signedUrl, true, 302);

Trial access and duration

An example of a link that limits one connection to 30 seconds can be obtained via: $duration = 30;
Duration limits a specific connection, not the user's overall subscription period. If you require a "first 30 minutes free" rule, store the start and end of the trial period in your database. Each time you call listen.php, pass only the remaining time, and return an HTTP 403 response after the period ends. Otherwise, the user will be able to reconnect and receive a new full limit.
Important! The player may play audio for several seconds longer than the duration value due to the already loaded start buffer, which depends on the stream's bitrate (usually up to 5 seconds).

IP address, proxy and mobile networks

The signature must include the public IP from which the listener will connect to MyRadio24. If the site is served through Cloudflare, a CDN, a reverse proxy, or a load balancer, configure the web server so that REMOTE_ADDR contains the client's real IP. Don't trust arbitrary X-Forwarded-For headers: they can be spoofed. Process them only for requests from your known proxy. When switching between Wi-Fi and a mobile network, the IP may change. The old key will then no longer work, and listen.php should return a new link the next time you connect.

Frequently asked questions

Why did the regular link stop working?
This happens after enabling the secret key. Use the signed link with the key parameter.
Why is the new link immediately rejected?
Check the secret key, listener IP, server system time, MD5 order, and duration value. The server time must be synchronized.
Why does the link work on one device but not on another?
It is tied to the IP for which it was created.
Why didn't the flow resume after the interruption?
The direct link may have expired. Use a permanent listen.php address in the player, which generates a new key for each authorized connection.
Why did the duration shutdown occur with a slight delay?
The player finishes playing the data it has received in the start buffer. This is normal streaming playback behavior.

Secret key security

1. Create links only on your server.
2. Do not place the secret key in HTML, JavaScript, a mobile app, or a public repository.
3. Use HTTPS and disable caching of listen.php responses.
4. Check access rights every time you connect.
5. Do not write the secret and full secure links in public logs.
6. If the secret is revealed, replace it in the control panel and on your server.
7. A secure link restricts access to the stream, but is not DRM and does not prevent an authorized listener from recording the audio being played.