Planes

Streams runs your live video and on-demand video on a plane: a media provider behind one API. You call the same endpoints whichever plane carries your video. Every live stream, asset, upload and signing key shows the plane that made it in its provider field.

Vabu sets the plane for your account. Cloudflare Stream suits audiences in Kenya and East Africa, because it serves video from Nairobi and encodes for free. The standard plane suits audiences around the world, audio-only streams and low-latency HLS. Test mode runs on a simulated plane that never reaches a provider and never bills.

What each plane can do

Code against these capabilities, not against the plane name. A request a plane cannot do is refused with 422 provider_rejected before anything is created.

Capability	Standard plane	Cloudflare Stream
Live streaming (live)	Yes	Yes
On-demand video (vod)	Yes	Yes
Audio-only live streams (audio_only)	Yes	No
Low-latency HLS (ll_hls)	Yes	No
WHIP ingest from a browser (whip_ingest)	No	Yes
SRT ingest (srt_ingest)	Yes	Yes
Simulcast to other platforms (simulcast)	Yes	Yes
Clips (clips)	Yes	Yes
DRM (drm)	No	No
Automatic captions (captions_auto)	Yes	No
Signed playback (signed_playback)	Yes	Yes
Signing keys of your own (delegated_signing)	Dedicated account	Dedicated account
Program date time in manifests (program_date_time)	Yes	No
Vertical clips (vertical_clips)	No	No

Signing keys of your own need a provider account that is only yours. On a shared account a key could sign for other customers' playback ids, so it is refused with 409 dedicated_environment_required.

Program date time lets a player place a moment on the exact frame it belongs to. Where a plane does not carry it, a player places moments from its own distance to the live edge instead.

Where Cloudflare Stream behaves differently

• One playback id per resource. Cloudflare gives each live stream and asset a single playback id, made with it from playback_policy. POST /v1/streams/playback_ids and DELETE /v1/streams/playback_ids/{id} answer 422 provider_rejected on this plane.
• Playback tokens. A token is a signed value that goes in the playback url in place of the id. It never lives more than 24 hours; the heartbeat of a viewer session keeps replacing it.
• Uploads. Send one POST with multipart/form-data and the file in the field file, up to 200 MB. The standard plane takes a PUT.
• SRT. Connect with ingest.srt_url, ingest.srt_stream_id and ingest.srt_passphrase. On the standard plane the SRT streamid is the stream key.
• WHIP. ingest.whip_url is a publish url that holds a secret. A stream sent over WHIP is watched over WebRTC (WHEP), is not recorded and cannot forward to simulcast targets, so it has no HLS source. Vabu playback grants have no WHEP source yet, so viewers cannot play a WHIP stream through /access today.
• Latency. Playback is standard HLS. latency_mode has no effect, and a keyframe interval of 4 to 8 seconds gives the lowest latency that stays smooth.
• Recordings. Every broadcast is recorded, because that is how HLS playback works. A live recording is deleted 30 days after the broadcast. Nothing deletes it sooner yet.
• Ending a broadcast. complete has no effect. The recording closes once the encoder has been gone for the reconnect_window, and the stream then reports idle.
• Rotating keys. reset_stream_key also changes the SRT passphrase and the WHIP url.
• Storage. Recordings use stored minutes. When the account has too little room left to record, going live is refused with 409 provider_storage_exhausted, and nothing is created.

To use your own Cloudflare account, read Cloudflare Stream setup.