Digital rights management

The Cloudinary Assets product provides ways to control digital rights for the assets in your product environment, including watermarks, asset expiration, access control, and roles and permissions.

Access control modes

When working with Cloudinary's API, there are a few ways you can control who can access an asset and when. These include:

• Storing an asset with an authenticated or private delivery type.
• Applying the access_control parameter.

If the first option above is applied on an asset, the asset's current access control mode is indicated in the Media Library with an icon, but you can't apply or modify the setting via the Media Library. It can be applied or modified only programmatically via the API. For more details, see Media access control on delivery.

The access_control option can be set programmatically via the API or via the Media Library.

Setting access control from the Media Library

If the access control option is enabled for your account or product environment, a DAM administrator can change any asset's access control mode between Public and Restricted directly from the Media Library.

Setting an asset as Restricted means that people can only view that asset outside the Media Library if they have both the asset URL and an authentication token (a special type of validation for ensuring that a person requesting a URL is allowed to access it). Downloads are also restricted if you've turned on the Block restricted asset downloads option in the Early Access page of the Media Library Preferences. The restrictions applies except during an optional time-limited date range when the asset is defined as publicly accessible.

If your users need to allow someone access to a restricted asset via a URL, outside the time range that an asset is set as public, work with the developers on your team to generate and distribute the required authentication token. For more details on authentication tokens, see Authenticated access to media assets.

Time-limited restricted access can be useful:

• If you have an image or video that's intended for a special campaign or that shows a new product design, and it's imperative that no one share the asset outside the organization prior to an official launch date.
• If you no longer want the public to be able to view or share an asset after the content is obsolete.
• If you need to enforce asset expiration dates. For more information, see Asset expiration.

When working with the access_control option, you can change assets from public to restricted, and add or change the time-limited access dates or times without changing the asset's URL in any way. This means that your developers don't need to change the URLs in their code when the access settings for that asset change.

To view or modify access control settings:

• For a single asset, open the access control settings dialog box (shown above) by clicking the Public or Restricted access control button in one of the following locations:

  • The Summary tab of the Media Library Preview pane
  • The Asset Management Summary tab

• For multiple assets, select the assets you want to update and choose Set Access Control from the (3-dots) option menu on the assets toolbar.

  Note

  You can update access control for up to 300 assets at a time, including any derived assets generated from the originally selected assets. Derived assets are generated when you apply transformations and then use the resulting variations outside the Media Library (open in a browser tab, download, deliver in a website or app, etc.).

• From the dialog box that opens, you can view or change the access control mode between public and restricted, or adjust the time-limited access for restricted assets.

When updating multiple assets, you'll receive an email notification upon completion, including a list of assets that couldn't be updated, if there are any.

Uploading with access control

If the same access control settings need to be applied to a set of assets being uploaded to the Media Library, you can configure upload preset(s) with the desired restrictions. Set the upload preset(s) as the default Media Library upload presets, and the required access control settings will be automatically applied to the assets being uploaded.

If you don't want to set the upload preset(s) as the default Media Library upload preset(s), users may be able to apply restricted access control settings by uploading assets via the Media Library Upload Widget and selecting the Upload Preset with the desired settings.

Asset expiration

Managing asset expiration helps ensure outdated or licensed content isn't used beyond its intended timeframe. This is important for:

• Preventing accidental use of expired/licensed content, reducing legal risk.
• Keeping your DAM system clean by archiving or restricting outdated assets.
• Ensuring teams access only current, approved content.

As a basis for restricting expired assets, you can set access control mode to Restricted with a defined time range for being Public, label assets as expired using metadata fields, and move them to Expired folders. Cloudinary provides several tools to support these approaches, including:

• EasyFlows: Automate actions like restricting access, updating metadata, moving assets to folders, or sending expiration reminder emails based on metadata dates or folder activity.
• Saved searches: Track upcoming expirations by filtering on metadata dates. You can save and share these searches to keep teams aligned.

Automate expiration with EasyFlows

For added flexibility, use EasyFlows to automate expiration-related actions based on changes in structured metadata, folder location, or other triggers.

EasyFlows setup

1. Navigate to MediaFlows by selecting the MediaFlows icon from the left sidebar of your Console. Then, click Create New and select EasyFlow.
2. Select triggers and actions using the intuitive, real language instructions within the interface. You can follow the examples below.

Examples

Here are a few ways to trigger expiration workflows automatically using EasyFlows:

When an asset reaches its expiration date

When the value of a specified metadata field of type date, such as the Status field, matches today’s date:

• Set the asset's access control to Restricted
• Move the asset to a restricted folder (e.g., Expired assets)
• Update the asset's structured metadata field value (e.g., Status = Expired)

When assets approach their expiration date

When the value of the expiration field falls within a set time range, such as 2 Weeks:

• Automatically send a summary email listing assets that are about to expire
• Customize the email content to notify the appropriate teams

When an asset moves to a specific folder

For example, when an asset moves to the Expired assets folder:

• Set access control to Restricted
• Update a structured metadata field value (e.g., Status = Expired)

Track expirations with saved searches

Users can create saved searches to help users easily keep track of assets that are about to expire. Saved searches provide a consistent, easy-to-access way to monitor time-sensitive assets without requiring users to manually rebuild search filters every time.

Example: Save a search called Expiring soon to display all assets expiring within 30 days:

1. Go to the Assets tab of the Media Library.
2. Click Add more to make sure the relevant structured metadata field (e.g., Expiration date) is visible.
3. In the filters, click the structured metadata field you want to filter by (e.g., Expiration date), select Within the next, and select the range (e.g., 30 days).
4. Click Save Search and give it a meaningful name.
5. In the Save Your Search dialog box, you can select to Invite teammates if you want to make the saved search available to others.
6. If you have an Assets Enterprise plan, you can display the saved search on your Homepage by clicking the star next to its name to mark it as a favorite.
7. Access your saved search anytime in the Advanced Search drop down.

Watermarks

Apply watermarks to your assets to help prevent unauthorized reuse and ensure branding or licensing requirements are visible.

There are a few ways to incorporate watermarks as part of your digital rights management strategy:

• Transformation templates: Apply watermark overlays using named transformations. You can define and reuse these templates in the Image Overlay tab in Studio to ensure consistent application across assets.

  Here's an example of managing watermarks in Studio:

  

  
  For more information, see Studio.

• Collection webpages: When sharing Collection webpages, you can prevent downloads of original assets and apply watermark transformations to all displayed versions.

  Here's an example of a publicly shared collection webpage that only allows downloading watermarked assets:

  

  
  For more information see Sharing collections externally via public links.

• Portals: Use Portals to display only watermarked versions of assets. This is useful for external sharing where asset protection is a priority.

  Here's where to configure allowing only watermarked asset downloads in your portal:

  

  
  For more information, see Portals.

Roles and permissions

Controlling who can view, edit, or share assets is a core part of digital rights management. By assigning roles and setting folder-level permissions, you can ensure only the right people have access to the assets they need for their work—nothing more.

This helps:

• Prevent unauthorized access or changes to licensed or restricted assets

• Support team-specific workflows and content governance

• Reduce the risk of misuse or accidental distribution

For more information, see Learn how to manage roles and permissions.

Manage access to assets on your website

Cloudinary offers several options for protecting your assets at the delivery stage. For more information on how developers can manage digital rights when delivering media on your website, see Media access methods.