---
title: Configuring delivery for HLS
framework: http-live-streaming
role: article
role_heading: Article
path: http-live-streaming/configuring-delivery
---

# Configuring delivery for HLS

Format media URLs and origin domain access for HTTP Live Streaming (HLS) delivery to Apple Podcasts.

## Overview

Overview Apple Podcasts requests your media from multiple domains, so correctly formatted URLs and Cross-Origin Resource Sharing (CORS) headers ensure your streams resolve and play without errors. Structure media URLs for Apple Podcasts Apple Podcasts supports multiple URL formats and redirection mechanisms: Configure CORS for Apple domains To support media playback on Apple sites, allow Cross-Origin Resource Sharing (CORS) from Apple-owned domains on your media hosts. You can configure your environment using either origin pattern matching or server-side origin validation. Both configuration options have the following requirements: Configure headers for all hosts in the delivery chain, including playlist and manifest servers, media segment hosts, and all HTTP redirect targets. Handle cache keys as follows: Include the Origin header in your CDN cache key. Return Vary: Origin on all responses containing Access-Control-Allow-Origin. Expose byte-range headers by returning Access-Control-Expose-Headers: Content-Range, Content-Length to enable media seeking. Do not return Access-Control-Allow-Credentials: true, as playback doesn’t require it. Configure origin pattern matching Use this approach if your CDN or cloud storage provider supports origin matching rules. If you’re using an origin storage service behind a CDN, configure CORS headers in one layer only (typically at the CDN) to prevent header conflicts or duplicate values. Configure your platform’s allowed origin field using one of the following options: note: Never return Access-Control-Allow-Origin: https://*.apple.com as a literal header value. Browsers reject wildcard subdomains in HTTP responses. Configure server-side origin validation If your hosting platform does not support origin pattern matching, or if you need application-level control, validate the incoming Origin header directly in server code: Inspect the incoming Origin request header. Validate that the value strictly matches an Apple domain — it starts with https:// and ends with .apple.com (with the leading dot), or is exactly https://apple.com. Avoid checks without the leading dot, as they could match untrusted domains. For example, https://not-apple.com and https://apple.com.example.com would defeat checks that omit the leading dot. If the domain matches, set Access-Control-Allow-Origin to the exact value received in the request’s Origin header. If the domain doesn’t match or is omitted, don’t return any Access-Control-* headers. Alternatively, if your media is fully public, your server can return Access-Control-Allow-Origin: * for all GET and HEAD requests.

## See Also

- [Authoring multivariant and media playlists](http-live-streaming/multivariant-and-media-playlists.md)
- [Encoding media for HLS](http-live-streaming/encoding-media.md)
- [Delivering ad interstitials in podcast streams](http-live-streaming/delivering-ad-interstitials.md)
- [Delivering WebVTT subtitles and captions in HLS](http-live-streaming/delivering-subtitles-and-captions.md)
- [Reviewing sample playlists and validating streams](http-live-streaming/examples-and-validation.md)
- [Handling downloads and playback](http-live-streaming/downloads-and-playback.md)