I’m trying to build a simple livestreaming platform for studying purposes. Currently, I’m using the nginx rtmp module, which sets up an rtmp application, and provides the contents via an HLS endpoint. Alogside the nginx server, I also built a Go API that handles users and livestreams information. The stream keys are hashed and stored on the database, so that only the streamer may use the key to generate content (using a software encoder like OBS for example). Now comes the problem:

If any user wants to watch the livestream, they would need to request the .m3u8 file in the hls endpoint, which has as the prefix the stream key (<stream-key>.m3u8), but, how could they possibly obtain that stream key value being the viewers (and by that, not having access to the private value of stream key)?

Obviously some other approach needs to be followed, because I cannot find a way to expose this stream in such a way that the creators can be safe, and the viewers can properly consume the content.

Can anyone suggest a approach so I can start tackling this problem?