Is there a better way to achieve fine-grained per-video access control while minimizing Workers requests?

[zein1016]

Question

Is there a better way to achieve fine-grained per-video access control while minimizing Workers requests?

Options I've considered:

1. R2 pre-signed URLs: Can't combine with edge caching (pre-signed URLs only work on accountid.r2.cloudflarestorage.com, caching requires custom domains)
2. Cloudflare Access: Requires public bucket + coarse bucket-level permissions (can't restrict per-video based on subscriptions)
3. HLS encryption (AES-128): Adds client CPU overhead, still need authenticated key endpoint

Requirements

• Per-video access control (user must be subscribed to specific creator)
• Edge caching for performance
• Support standard HLS players
• Private R2 storage

Is the current time-window token + Worker + edge cache approach the recommended solution? Or is there a pattern I'm missing?

---

Usage: ~14,500 Workers requests/day (well under free tier), just want to confirm this is best practice.