there's so many options that it's difficult to say. Two options are immediately obvious: First option is to serve only encrypted content, and only hand out th

there's so many options that it's difficult to say. Two options are immediately obvious: First option is to serve only encrypted content, and only hand out the decryption key to the parties that need it. If it's web then you can use javascript to unencrypt- though I'm not a web developer and that could be cumbersome. This was how we did it for uPlay. Second option: Akamai/Google CDN have the concept of a "signed" URL: https://cloud.google.com/cdn/docs/using-signed-urls https://cloud.google.com/cdn/docs/using-signed-urls which does basically what you're asking, but can be cumbersome to use in practice too.