Audio and video content sales on website

Implementing Audio/Video Content Sales on a Website

Media content sales (music tracks, podcasts, educational videos, films, documentaries) are technically harder than PDF sales. Main issues — streaming protection from unauthorized access, bandwidth management, and simultaneous business models: one-time purchase (own) vs subscription (stream).

Two Delivery Modes

Download-to-own: user pays once, downloads file. Applicable for music tracks, audiobooks, individual video lectures. Mechanism identical to ebook sales — S3 + temporary signed URLs.

Stream-only: user watches/listens online, can't download. Applicable for films, series, subscription courses. Requires special infrastructure.

Direct S3 distribution for streaming is not ideal for two reasons: traffic cost and inability to control concurrent sessions. Correct stack:

S3 (origin) → CloudFront CDN → Signed Cookies → Player (HLS.js / Shaka Player)

Video Streaming via CloudFront + HLS

Video stored in S3 at source quality (MOV/MP4 4K). AWS MediaConvert transcodes to multiple bitrates and packages as HLS (.m3u8 + .ts segments):

output/
  movie-uuid/
    index.m3u8          # master playlist
    360p/stream.m3u8
    720p/stream.m3u8
    1080p/stream.m3u8
    360p/seg-000.ts
    360p/seg-001.ts
    ...

CloudFront distributes with signed cookies (not URL — cookies to cover all segments with one signature):

// Generate CloudFront signed cookies
use Aws\CloudFront\CloudFrontClient;

$cf = new CloudFrontClient(['region' => 'us-east-1', 'version' => 'latest']);

$policy = json_encode([
    'Statement' => [[
        'Resource' => "https://cdn.example.com/output/{$movie->uuid}/*",
        'Condition' => [
            'DateLessThan' => ['AWS:EpochTime' => time() + 14400], // 4 hours
            'IpAddress'    => ['AWS:SourceIp' => $request->ip() . '/32'],
        ],
    ]],
]);

$cookies = $cf->getSignedCookie([
    'policy'      => $policy,
    'private_key' => storage_path('app/cf-private-key.pem'),
    'key_pair_id' => env('CLOUDFRONT_KEY_PAIR_ID'),
]);

// Return cookies in Set-Cookie headers
foreach ($cookies as $name => $value) {
    Cookie::queue($name, $value, 240, '/', '.example.com', true, true, false, 'None');
}

Frontend player receives cookies via /api/media/{id}/access endpoint, then plays HLS:

import Hls from 'hls.js';

const hls = new Hls({
  xhrSetup: (xhr) => {
    xhr.withCredentials = true; // send CloudFront cookies
  },
});

hls.loadSource(`https://cdn.example.com/output/${movieUuid}/index.m3u8`);
hls.attachMedia(videoElement);

Audio Streaming

For audio (music, podcasts) schema is simpler. MP3/AAC/FLAC files stored in S3. For streaming without download use CloudFront signed URL with limited lifetime and IP binding:

$signedUrl = $cloudFront->getSignedUrl([
    'url'         => "https://cdn.example.com/audio/{$track->file_key}",
    'expires'     => time() + 7200,
    'private_key' => storage_path('app/cf-private-key.pem'),
    'key_pair_id' => env('CLOUDFRONT_KEY_PAIR_ID'),
]);

For preview (30-second sample) store separate file {uuid}-preview.mp3 in publicly accessible CDN path.

View Analytics

Critical for video: watchability, exit points. Affects recommendation system and shows what content works.

// Send heartbeat every 10 seconds
let lastReported = 0;
videoElement.addEventListener('timeupdate', () => {
    const current = Math.floor(videoElement.currentTime);
    if (current - lastReported >= 10) {
        navigator.sendBeacon('/api/analytics/heartbeat', JSON.stringify({
            content_id: contentId,
            position:   current,
            duration:   Math.floor(videoElement.duration),
        }));
        lastReported = current;
    }
});

navigator.sendBeacon doesn't block tab closing — data arrives even if user suddenly closes browser.

Subscription Model

For streaming service (Netflix-like) use Stripe Subscriptions:

const subscription = await stripe.subscriptions.create({
  customer: customer.stripe_id,
  items: [{ price: 'price_monthly_plan' }],
  payment_behavior: 'default_incomplete',
  expand: ['latest_invoice.payment_intent'],
});

Table subscriptions(user_id, stripe_subscription_id, plan, status, current_period_end). Webhook customer.subscription.updated / customer.subscription.deleted syncs status. Middleware checks subscriptions.status = 'active' and current_period_end > now().

Quality Management and Adaptive Streaming

ABR (Adaptive Bitrate) — HLS auto-switches quality per connection speed. But set transcoding rules in MediaConvert:

Implementation Timelines

Total: 9–11 working days for full platform with subscription and streaming.

Common Issues

Hotlinking. If URL is predictable or unprotected, bots and users will share direct links. CloudFront Signed Cookies + IP binding solve this.

Mobile buffering. HLS segments of 6–10 seconds give good balance. Too short (2s) increases HTTP requests, too long (20s) increases initial delay.

Concurrent sessions. Subscription platforms often limit simultaneous views. Implemented via Redis: SET stream:{user_id}:{session_id} EX 30 updated every 10 seconds. If active key count for stream:{user_id}:* exceeds limit — new session blocked.