Seeking Advice for Video request API.

I will be building an API for one of our products which displays videos our customer website. The API will be private to start with. Only partners will have access to the api. The api will give them access to our video library and product registration. I'm trying to think of the best way to make the video links and widget secure as posible. Limiting access to those who have an API key and whose websites have been authorized to show the videos. Currently we are small and do not have a CDN but im sure this will change real soon. Currently with out the API I am displaying the videos and widget through Iframe. The Iframe has a token that is checked to see if the website displaying the video is registered with us. For each video, in the Iframe I have a token that indicates which video to display the token created by using they domain name. Once it has been authorized I push out the file and I do not directly link to it. In the event we switch to a CDN I really do not know how to securely stream our content. I know if someone really wants the videos they will get them but I'm just trying to make it as secure as posible. With the videos directly on the server I can put the videos in a none web root and push it out if needed. Any advice would be appreciated.