# How to Install the Secure Token Integration

Azion **Secure Token** is a *serverless* integration available at Azion Marketplace.

With the help of the Azion Secure Token integration, you can make token-based, time-limited URLs. The creation and validation of signatures for cookies, authentication headers, and other security measures can be done using these tokens, which can be altered in a variety of ways. Utilizing both HLS and Progressive Download, the solution is frequently used to secure video assets, including those used for live streaming and on-demand content.

---

## Getting the integration

To use the **Secure Token** integration provided by Azion Marketplace, you have to:

1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Marketplace**.
2. On the Marketplace homepage, select **Secure Token** card.
3. Once the integration's page opens, click the **Install** button.

You'll see a message indicating that your integration was successfully installed.

:::tip
You can search any integration by browsing through the cards, using the filters, or typing a keyword in the search bar.
:::

---

## Generating the token

In order to use this integration, you'll have to generate a token. To do so, follow these steps:

1. Go to the [Azion's Secure Token GitHub repository](https://github.com/aziontech/azion_secure_token).
    - In this repository, you'll find a brief explanation about how the Secure Token is generated and how to use it.
2. In the repository, you'll find two example scripts to generate the tokens, a `Python` and a `PHP` script. You can run them locally and generate the token or you can generate these tokens on your own platform with your own code.
3. Save the generated token, whatever may be the way you generated it through.

Using the Python script as an example, you'll have the following source code:

```python
#!/usr/bin/env python

import base64
import hashlib

secret = 'mysecret'
uri = '/my/uri'
expire = '1470055000'

md5 = hashlib.md5()
md5.update(secret + uri + expire)
token = base64.b64encode(md5.digest()).replace('=','').replace('+','-').replace('/','_')

print 'http://www.example.org%s?st=%s&e=%s' % (uri, token, expire)
```

Where:
- `secret`: a string of your choice that will be used to generate the token.
- `uri`: the URI to use with the token.
- `expire`: the expiration time of the token.

---

## Configuring the integration

### Setting up an firewall

To instantiate the **Secure Token** integration, follow the steps:

1. In the **Products menu**, select **Firewall** in the **Secure** section.
2. Click the **+ Firewall** button.
3. Give an easy-to-remember name to your firewall.
4. Turn the **Functions** switch on.
5. Click the **Save** button.

Done. Now you've instantiated the firewall for your function.

### Setting up the integration

To instantiate the **Secure Token** integration, while still on the Firewall page:

1. Select the **Functions Instances** tab.
2. Click the **+ Function Instance** button.
3. Give an easy-to-remember name to your instance.
4. On the dropdown menu, select the **Secure Token** function.
  - This action will load the **Arguments** tab.

The **Arguments** tab will load a `JSON` file that looks like this:

```json
{
    "secure_token_secret": "thatisthesecret"
}
```

Where the `secure_token_secret` will be the secret string you've passed on the code when generating the token on the previous step.

5. Click the **Save** button and you're done. Your Firewall Secure Token integration is now instantiated.

### Setting up the Rules Engine

To finish, you have to set up the [Rules Engine](/en/documentation/products/secure/firewall/rules-engine/) to configure the *behavior* and the *criteria* to run the function.

Still in the **Firewall** page:

1. Select the **Rules Engine** tab.
2. Click the **+ Rule Engine** button.
3. Give a name to the rule.
4. Select a *criteria* to run and catch the domains that you want to run the integration on.
  - Example: if `Host` *matches* `yourdomain.com`.
5. Below, select a *behavior* to the *criteria*. In this case, it'll be **Run Function**. 
   - Select the adequate function according to the name you gave it during the instantiation step.
6. Click the **Save** button.

On the Console, you must now configure your domain so your firewall protects it.

7. On the **Products menu**, select **Workloads**.
8. Click on the domain you want to protect with your Secure Token function.
9. In the **Settings** section, click on the `Firewall` selector and choose the firewall you created.
10. Click the **Save** button.

:::note
The function running on edge servers performs two checks on tokens: whether the current time is greater than the expiration time specified in the token, and whether the signature matches the token signature. If the signature is invalid, the system returns a 403 error, and if the expiry time is exceeded, it returns a 410 error. Malicious users aren't able to change token expiry time without breaking signature.
:::

Done. Now the **Secure Token** integration is running for every request made to the domain you indicated.

:::tip
You can find some examples of code snippets at the [Azion public GitHub repository](https://github.com/aziontech/azion_secure_token) for Secure Token integration.
:::

---