AFAIK state-of-the-art is requesting a signed URL with a timestamp from whatever system can verify you paid, then presenting that to the file server, which vali

AFAIK state-of-the-art is requesting a signed URL with a timestamp from whatever system can verify you paid, then presenting that to the file server, which validates the signature and can also elect not to serve links with a too-old timestamp (limiting the damage a leaked URL can do).