# Identity for Media and Streaming: Sharing, Profiles, and TV Sign-In Source: https://startwithidentity.com/articles/identity-for-media-streaming/ Last updated: 2026-10-16 License: content by Start with Identity. Cite the source URL. --- Media and streaming identity is unusual because login is the revenue boundary. The account decides which content a viewer can watch, how many screens can play at once, which profile's recommendations they see, and whether the person on the couch is part of the paying household. That makes the identity layer an enforcement point for the business model, running on phones, browsers, smart TVs, consoles, and streaming sticks at very large scale. See the [media and streaming vertical](https://startwithidentity.com/verticals/media-streaming/) page for the sector overview. ## Accounts, households, and paid sharing For years, password sharing was tolerated. In a [February 2023 update](https://about.netflix.com/en/news/an-update-on-sharing), Netflix said more than 100 million households were sharing accounts and that "a Netflix account is intended for one household." It introduced paid "extra member" sub-accounts and profile transfer in several markets. Whatever a given service decides commercially, enforcing a household rule needs identity plumbing: - A defined primary household and a record of the devices and sessions associated with it. - Step-up verification (a code to the account owner's email or phone) for devices that appear outside the household. - A clean path to convert a borrower into an extra member or a new account without losing their history. - Session and device lists that the account owner can see and revoke. A [shared account](https://startwithidentity.com/glossary/shared-account/) is also a security problem, not only a revenue one. When a password is sent to friends and family, the owner loses track of where it is stored, and a credential reused across services is exactly what [credential stuffing](https://startwithidentity.com/techniques/credential-stuffing/) exploits. ## Concurrency limits and entitlements Plans differ by how many streams can play at once, which resolution is allowed, and whether ads are shown. Those checks happen at playback, not at login, so the identity token needs to carry (or let the playback service look up) the subscription tier, the household, and the profile. Two design rules help: - Keep entitlements server-side and short-lived. A token that encodes the plan for weeks lets access outlive a cancellation or downgrade. - Count concurrency per active playback session, not per login, and give users a way to end streams on other devices. ## Profiles are not accounts Profiles separate viewing history, recommendations, and parental controls inside one subscription. They are usually not separate authentication principals: anyone signed in to the account can switch between them unless a profile PIN is set. That matters for children's profiles, where [COPPA](https://startwithidentity.com/regulations/united-states/coppa/) in the US and [GDPR](https://startwithidentity.com/regulations/european-union/gdpr/) in the EU affect what data is collected about child viewers, and for privacy between adult household members. Treat a profile lock as a convenience control, and keep account-level changes behind real authentication. ## TV and console sign-in Typing an email and a strong password with a remote is slow, which is why most living-room apps use the [OAuth 2.0](https://startwithidentity.com/standards/oauth-2-0/) device authorization grant, published as [RFC 8628](https://www.rfc-editor.org/rfc/rfc8628) in August 2019. The TV shows a short code and a URL, the user approves it on a phone that is already signed in, and the TV polls for tokens. Our glossary entry on the [device code flow](https://startwithidentity.com/glossary/device-code-flow/) walks through the steps. The same flow is a known phishing vector. In [device code phishing](https://startwithidentity.com/techniques/device-code-phishing/), an attacker starts a flow and persuades a victim to enter the code, receiving tokens for the victim's account. Microsoft [reported](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/) a large campaign using this technique against enterprise accounts in February 2025. Streaming services can reduce the risk with short code lifetimes, an approval screen that names the device and location, rate limits on code entry, and a notification to the account owner whenever a new TV is linked. ## Takeover at scale Streaming credentials are resold in bulk, and a takeover often goes unnoticed because the attacker only watches. The core defenses are bot and velocity controls at login, [passkeys and passwordless](https://startwithidentity.com/articles/passwordless-ciam-guide/) sign-in on phones and browsers, new-device alerts, and [step-up authentication](https://startwithidentity.com/glossary/step-up-auth/) before changes to email, password, payment method, or household. After a password reset, revoke every refresh token and device session, including TVs, or the attacker keeps watching. Scale shapes everything else. Premieres and live sports produce sudden login and token-refresh spikes, so the identity service, token issuance, and entitlement lookups all need headroom and caching that does not weaken revocation. That places streaming firmly in [high-scale CIAM](https://startwithidentity.com/rankings/best-ciam-for-high-scale/) territory. ## Choosing a platform Developer-oriented customer identity platforms such as [Auth0](https://startwithidentity.com/vendors/ciam/auth0/) (an Okta company) and [Stytch](https://startwithidentity.com/vendors/ciam/stytch/) (acquired by Twilio in 2025) cover device grant, passwordless, and bot defense, while [Amazon Cognito](https://startwithidentity.com/vendors/ciam/amazon-cognito/) suits AWS-native streaming stacks that want to build more themselves. Test device-grant UX on real TVs, session revocation across device types, and pricing at your monthly active user count. Compare options in the [best CIAM platforms](https://startwithidentity.com/rankings/best-ciam-platforms/) and [passwordless CIAM providers](https://startwithidentity.com/rankings/best-passwordless-ciam-providers/) rankings, and check privacy obligations by market in the [regulations hub](https://startwithidentity.com/regulations/). In streaming, the identity system that signs viewers in is the same system that protects revenue, so design both jobs together.