Phase D · Resource-server enforcement

Ask one question before serving licensed content: “Is this exact resource permitted now?”

The ContentDividend Resource-Server Authorization Kit gives a publisher, CDN, reverse proxy, application server, or edge worker a server-to-server decision endpoint backed by the same active license and publisher-authorized resource state used throughout ContentDividend.

Important: the authorization endpoint does not create a license. It checks an existing OLP License Token against the exact requested resource and returns an allow/deny decision plus a short-lived signed verification receipt when signing is available.

1. Agent presents tokenReceive the RSL/OLP License Token.

2. Resource server checksSend the token and exact URL to ContentDividend.

3. Rights are recheckedActive token + current publisher authorization are evaluated.

4. Serve or denyUse decision and permitted to enforce access.

Exact-resource authorization

A token valid for one URL is not silently treated as permission for a different publisher resource.

Live rights state

Expired, revoked, superseded, or publisher-deauthorized access returns a denial even if an older token or signed receipt still exists.

Auditable response

Each authorization check receives a request ID and can include a short-lived Ed25519-signed verification receipt.

Authorization endpoint

Use this only from trusted server-side infrastructure. Never expose the OLP client secret in browser JavaScript.

POST https://app.contentdividend.com/rsl/olp/resource-server/authorize
Authorization: Basic base64(client_id:client_secret)
Content-Type: application/x-www-form-urlencoded

token=YOUR_LICENSE_TOKEN&resource=https%3A%2F%2Fpublisher.example%2Farticle

Example decision

{
  "decision": "allow",
  "active": true,
  "permitted": true,
  "resource": "https://publisher.example/article",
  "recommended_resource_response_status": 200,
  "authorization_source": "publisher_authorized_content_access",
  "agent_verification_receipt": { "...": "short-lived signed receipt" }
}

Python server example

import requests
from requests.auth import HTTPBasicAuth

response = requests.post(
    "https://app.contentdividend.com/rsl/olp/resource-server/authorize",
    auth=HTTPBasicAuth(CLIENT_ID, CLIENT_SECRET),
    data={"token": license_token, "resource": requested_url},
    timeout=5,
)
decision = response.json()
if not decision.get("permitted"):
    # Return 403, 402 + license link, or your site's own denial response.
    deny_request()
serve_content()

Cloudflare Worker pattern

const auth = btoa(`${env.CD_OLP_CLIENT_ID}:${env.CD_OLP_CLIENT_SECRET}`);
const body = new URLSearchParams({ token: licenseToken, resource: request.url });
const check = await fetch(
  "https://app.contentdividend.com/rsl/olp/resource-server/authorize",
  { method: "POST", headers: { Authorization: `Basic ${auth}` }, body }
);
const result = await check.json();
if (!result.permitted) return new Response("License required", { status: 403 });
return fetch(request);

Store both credentials as server-side/Worker secrets. Do not hard-code them into public HTML or client JavaScript.

Conformance and machine discovery

Open Conformance Matrix Open Machine Descriptor

The matrix records ContentDividend's tested implementation profile and known gaps. It is not a claim of third-party RSL certification.