# Generate a signed HMAC token

Each segment or manifest request made using pod serving must include a
HMAC-signed token for authentication, as a fallback of
[early ad break notifications](https://developers.google.com/ad-manager/video/Early.ad.break.notification).

This token can be calculated once per ad break and shared across all stream
sessions.

## Gather token parameters

Gather the following information from the current ad break, to populate the
token body.

| Token Parameters |||
|---|---|---|
| `ad_break_id` | Required if `pod_id` parameter is not provided. | The string identifier for the ad break. |
| `custom_asset_key` | Required if `event` parameter is not provided. | The custom livestream asset key, from Google Ad Manager. |
| `cust_params` | Optional | The custom targeting parameters for the ad break. |
| `event` | Required if `custom_asset_key` parameter is not provided. | The livestream asset key, generated by Google Ad Manager. |
| `exp` | Required | Expiration timestamp for this token in seconds. |
| `network_code` | Required if `custom_asset_key` parameter is provided. | The Ad Manager 360 network code for this network. |
| `pod_id` | Required if `ad_break_id` parameter is not provided. | The numerical identifier for the ad break. |
| `pd` | Required, except for events with duration-less ad breaks enabled. | The duration in milliseconds of the ad break. |
| `scte35` | Optional | The Base64-encoded SCTE-35 signal for the ad break. |

**Create token string {:.numbered}**

list each parameter in alphabetical order, in the format `name=value`, with each
name-value pair separated by a tilde (`~`) character.

Optional parameters without a value can be left in-place with an empty string
for the value, or removed entirely.

**Token string format**

    custom_asset_key={custom_asset_key}~exp={expiration}~network_code={network_code}~pd={pod_duration}~pod_id={ad_pod_index}~scte35={scte35_message}

**Generate HMAC signature {:.numbered}**

The HMAC signature is a SHA-256 hash of the token string in HEX format. The
secret key is the
[HMAC authentication key](https://support.google.com/admanager/answer/6381445)
associated with your livestream event in Google Ad Manager.

**Sign token string {:.numbered}**

Once generated, append the HMAC signature to the token string in the following
format

    ~hmac={HMAC signature}

**URL-encode token string {:.numbered}**

This token is passed as a URL parameter, so it must be URL-encoded for safety.

**Example 1**

Here's an example where unused optional parameters are included as empty
strings.

**Token string**

    cust_params=~custom_asset_key=iYdOkYZdQ1KFULXSN0Gi7g~exp=1489680000~network_code=6062~pd=180000~pod_id=5~scte35=

**Secret key**

    A7490591290583E4B93189DEE7E287C299FC686872ABC7ADC9F9F536443505F

**HMAC signature**

    ea1081cc1ab83cacd1e64073fc19e64616b2571249232917dc9f539cafb4b94e

**Signed token**

    cust_params=~custom_asset_key=iYdOkYZdQ1KFULXSN0Gi7g~exp=1489680000~network_code=6062~pd=180000~pod_id=5~scte35=~hmac=ea1081cc1ab83cacd1e64073fc19e64616b2571249232917dc9f539cafb4b94e

**URL-encoded signed token:**

    cust_params%3D~custom_asset_key%3DiYdOkYZdQ1KFULXSN0Gi7g~exp%3D1489680000~network_code%3D6062~pd%3D180000~pod_id%3D5~scte35%3D~hmac%3Dea1081cc1ab83cacd1e64073fc19e64616b2571249232917dc9f539cafb4b94e

**Example 2**

Here's an example where the unpopulated optional variables are omitted entirely.

**Token string**

    custom_asset_key=iYdOkYZdQ1KFULXSN0Gi7g~exp=1489680000~network_code=6062~pd=180000~pod_id=5

**Secret Key**

    A7490591290583E4B93189DEE7E287C299FC686872ABC7ADC9F9F536443505F

**HMAC signature**

    6a8c44c72e4718ff63ad2284edf2a8b9e319600b430349d31195c99b505858c9

**Signed token**

    custom_asset_key=iYdOkYZdQ1KFULXSN0Gi7g~exp=1489680000~network_code=6062~pd=180000~pod_id=5~hmac=6a8c44c72e4718ff63ad2284edf2a8b9e319600b430349d31195c99b505858c9

**URL-encoded signed token**

    custom_asset_key%3DiYdOkYZdQ1KFULXSN0Gi7g~exp%3D1489680000~network_code%3D6062~pd%3D180000~pod_id%3D5~hmac%3D6a8c44c72e4718ff63ad2284edf2a8b9e319600b430349d31195c99b505858c9

**Example 3**

Here's an example with `ad_break_id`.

**Token string**

    ad_break_id=adbreak1~custom_asset_key=iYdOkYZdQ1KFULXSN0Gi7g~exp=1489680000~network_code=6062~pd=180000

**Secret key**

    A7490591290583E4B93189DEE7E287C299FC686872ABC7ADC9F9F536443505F

**HMAC signature**

    327b23b80d032b0fa4c41b64a5e44fa7733af5bdbf173b7d89135aef05ae6d29

**Signed token**

    ad_break_id=adbreak1~custom_asset_key=iYdOkYZdQ1KFULXSN0Gi7g~exp=1489680000~network_code=6062~pd=180000~hmac=327b23b80d032b0fa4c41b64a5e44fa7733af5bdbf173b7d89135aef05ae6d29

**URL-encoded signed token**

    ad_break_id%3Dadbreak1~custom_asset_key%3DiYdOkYZdQ1KFULXSN0Gi7g~exp%3D1489680000~network_code%3D6062~pd%3D180000~hmac%3D327b23b80d032b0fa4c41b64a5e44fa7733af5bdbf173b7d89135aef05ae6d29

## Token Generator

### Unsigned URL

### From parameters

| Content identifier ||
|---|---|
| Livestream asset key (event): |   |
| Custom Asset Key: |   |
| Network Code: |   |
| CMS ID (cmsid): |   |
| Video ID (vid): |   |
| Ad Break ID: |   |
| Pod ID: |   |
| Cust Params: |   |
| Macros: |   |
| Pod Duration (pd): |   |
| SCTE35: |   |

| Token options ||
|---|---|
| Expiration (exp): |   |
| HMAC key: |   |

## Results

```

```