diff --git a/backend/modules/medias/controller.go b/backend/modules/medias/controller.go
index f752df3..5a39880 100644
--- a/backend/modules/medias/controller.go
+++ b/backend/modules/medias/controller.go
@@ -83,6 +83,8 @@ func (c *Controller) MediaIndex(ctx fiber.Ctx) error {
 		return errorx.RequestUnAuthorized
 	}
 
+	// c.Locals(consts.CtxKeyJwt, token)
+	token := fiber.Locals[string](ctx, consts.CtxKeyJwt)
 	model, err := c.svc.GetMediaByHash(ctx.Context(), claim.TenantID, hash)
 	if err != nil {
 		log.WithField("action", "medias.MediaIndex").WithError(err).Error("GetMediaByHash")
@@ -95,7 +97,7 @@ func (c *Controller) MediaIndex(ctx fiber.Ctx) error {
 		return err
 	}
 
-	playlist, err := c.svc.GetM3U8(ctx.Context(), claim.TenantID, mediaType, model.Hash, bought)
+	playlist, err := c.svc.GetM3U8(ctx.Context(), claim.TenantID, mediaType, model.Hash, bought, token)
 	if err != nil {
 		log.WithField("action", "medias.MediaIndex").WithError(err).Error("GetMediaPlaylist")
 		return err
diff --git a/backend/modules/medias/service.go b/backend/modules/medias/service.go
index da14b66..eaecef4 100644
--- a/backend/modules/medias/service.go
+++ b/backend/modules/medias/service.go
@@ -279,7 +279,7 @@ func (svc *Service) Upsert(ctx context.Context, tenantId int64, item media_store
 }
 
 // get video m3u8
-func (svc *Service) GetM3U8(ctx context.Context, tenantId int64, types pg.MediaType, hash string, bought bool) (m3u8.Playlist, error) {
+func (svc *Service) GetM3U8(ctx context.Context, tenantId int64, types pg.MediaType, hash string, bought bool, token string) (m3u8.Playlist, error) {
 	log := svc.log.WithField("method", "GetM3U8")
 	indexPath := filepath.Join(svc.storageConfig.Path, fmt.Sprintf("%d", tenantId), hash, types.String(), "index.m3u8")
 	log.Infof("m3u8 path: %s", indexPath)
@@ -335,6 +335,9 @@ func (svc *Service) GetM3U8(ctx context.Context, tenantId int64, types pg.MediaT
 			return nil, errors.Wrap(err, "encode hash id")
 		}
 		seg.URI = fmt.Sprintf("%s/%s.%s", types, hashID, ext)
+		if token != "" {
+			seg.URI += fmt.Sprintf("?token=%s", token)
+		}
 	}
 
 	return media, nil
diff --git a/backend/modules/medias/service_test.go b/backend/modules/medias/service_test.go
index 10697d4..02ba144 100644
--- a/backend/modules/medias/service_test.go
+++ b/backend/modules/medias/service_test.go
@@ -45,15 +45,15 @@ func Test_DiscoverMedias(t *testing.T) {
 func (t *ServiceTestSuite) Test_getM3U8() {
 	FocusConvey("Test_ffmpegVideoToM3U8", t.T(), func() {
 		Convey("Bought", func() {
-			hash := "f464a6641a60e2722e4042db8fad2813"
-			media, err := t.Svc.GetM3U8(context.Background(), 1, pg.MediaTypeVideo, hash, true)
+			hash := "907f1c8fd92704233600ae54a1d75092"
+			media, err := t.Svc.GetM3U8(context.Background(), 1, pg.MediaTypeVideo, hash, true, "hello")
 			So(err, ShouldBeNil)
 			t.T().Logf("%+v", media)
 		})
 
 		FocusConvey("Not Bought", func() {
-			hash := "f464a6641a60e2722e4042db8fad2813"
-			media, err := t.Svc.GetM3U8(context.Background(), 1, pg.MediaTypeVideo, hash, false)
+			hash := "907f1c8fd92704233600ae54a1d75092"
+			media, err := t.Svc.GetM3U8(context.Background(), 1, pg.MediaTypeVideo, hash, false, "hello")
 			So(err, ShouldBeNil)
 			t.T().Logf("%+v", media)
 		})
diff --git a/backend/modules/middlewares/m_jwt_parse.go b/backend/modules/middlewares/m_jwt_parse.go
index 4bed93a..4c85118 100644
--- a/backend/modules/middlewares/m_jwt_parse.go
+++ b/backend/modules/middlewares/m_jwt_parse.go
@@ -13,7 +13,11 @@ import (
 func (f *Middlewares) ParseJWT(c fiber.Ctx) error {
 	tokens := c.GetReqHeaders()["Authorization"]
 	if len(tokens) == 0 {
-		return c.Next()
+		queryToken := c.Query("token")
+		tokens = []string{queryToken}
+		if len(tokens) == 0 {
+			return c.Next()
+		}
 	}
 
 	token := tokens[0]
diff --git a/frontend/src/views/PlayView.vue b/frontend/src/views/PlayView.vue
index a730054..0ab2d8c 100644
--- a/frontend/src/views/PlayView.vue
+++ b/frontend/src/views/PlayView.vue
@@ -129,11 +129,11 @@ const loadMedia = (hash) => {
 
 const play = (hash, type) => {
   const player = document.getElementById("video");
-  const source = `/v1/medias/${hash}/${type}`;
+  const source = `/v1/medias/${hash}/${type}?token=${__GA}`;
   if (Hls.isSupported()) {
     var hls = new Hls({
       xhrSetup: function (xhr, url) {
-        xhr.setRequestHeader("Authorization", "Bearer " + __GA);
+        xhr.withCredentials = true;
       },
     });
     hls.loadSource(source);
@@ -142,19 +142,10 @@ const play = (hash, type) => {
       player.play();
     });
   } else if (player.canPlayType("application/vnd.apple.mpegurl")) {
-    var xhr = new XMLHttpRequest();
-    xhr.open('GET', source, true);
-    xhr.setRequestHeader("Authorization", "Bearer " + __GA);
-    xhr.responseType = 'blob';
-    xhr.onload = function () {
-      if (xhr.status === 200) {
-        player.src = URL.createObjectURL(xhr.response);
-        player.addEventListener("loadedmetadata", function () {
-          player.play();
-        });
-      }
-    };
-    xhr.send();
+    player.src = source;
+    player.addEventListener("loadedmetadata", function () {
+      player.play();
+    });
   }
 };
 </script>