A YouTube stream key is a credential, not just another setting in your FFmpeg command. Protect it as you would a password, use encrypted transport such as RTMPS, and reset it in YouTube Live Control Room if you think it has been exposed.
For a reliable 24/7 channel, keep the key separate from your media playlist and treat playback order as a different problem. FFmpeg’s concat demuxer can read a plain text file in a fixed order, but stream copy only works when the inputs are compatible enough to be joined without re-encoding.
Treat the stream key as a credential
YouTube describes stream keys as being like a stream’s password and address. The encoder uses the key to identify the feed it is sending, while YouTube uses it to accept that feed. Anyone who obtains it may be able to send content to the channel’s live input, so it should not appear casually in notes, screenshots, support tickets or deployment bundles.
The key is separate from the videos you intend to play. A text playlist can be safe to share with a colleague because it contains media paths and ordering instructions. It should not contain the stream key, and neither should a playlist-generation script unless there is a specific, reviewed reason for doing so.
In YouTube Studio, open Go Live or Live Control Room and use the Stream tab to manage the key. YouTube’s encoder setup guidance explains where the stream URL and stream key belong in an encoder. Copy them into the corresponding settings, then avoid leaving the value in documents that are routinely backed up or shared.
This article deliberately does not present one VPS secret-storage recipe as universally safe. The right method depends on your operating system, service manager, FFmpeg build, account permissions and hosting environment. A file permission that is sensible on one machine may be wrong for a shared machine, and a launch method that avoids one exposure may create another in logs or deployment records.
Before you put the channel online, decide who can access the VPS, who can manage the YouTube channel and who can change the stream configuration. YouTube recommends giving channel administrative access only to trusted people. Audience visibility settings such as public, private and unlisted control who can watch a broadcast; they do not replace credential protection.
Create a text playlist with file directives
FFmpeg’s concat demuxer reads a text file containing directives. The simplest useful directive is file, followed by the path to one media file. For example, create playlist.txt:
ffconcat version 1.0
file '/srv/channel/media/morning-aarti.mp4'
file '/srv/channel/media/bhajan-loop.mp4'
file '/srv/channel/media/evening-aarti.mp4'
The first line identifies the format explicitly. The remaining lines describe the files in the order FFmpeg should open them. This file does not download anything from a YouTube playlist. It only points FFmpeg at files that already exist on the VPS or at locations available to the FFmpeg process.
Use complete paths when the stream is operated by a service account or an automated job. Relative paths depend on the process’s working directory, which may not be the directory you expect when FFmpeg starts after a reboot. A full path makes the playlist easier to test and reduces a class of failures where the first file cannot be found.
The quoting rules matter when a path contains spaces or special characters. Keep filenames simple where possible. If you must use spaces, quote the path and test the exact playlist with the same user account that will run the stream. Do not assume that a playlist tested in an interactive shell will behave identically under a service manager.
A playlist is operational configuration, so give it a clear owner and make it writable only by the people or process that need to change it. That recommendation protects the playback schedule, not the YouTube credential. Keep the key out of this file even if the playlist is stored in the same project directory.
For a music, devotional or study channel, it is useful to keep the media directory and the playlist directory distinct. The media directory contains the inputs. The playlist is the small control file that decides the order. This makes it possible to change the schedule without editing a command containing the stream destination.
If you maintain a channel from daily recordings, the guide to running a 24/7 market or share-bazaar update channel from daily recordings covers the broader scheduling problem. The same separation between source files and playback control is useful for devotional, local-news and educational channels.
Put entries in the intended playback order
The concat demuxer processes entries from top to bottom. If morning-aarti.mp4 is first, it is opened first. When it reaches the end, FFmpeg moves to bhajan-loop.mp4, then to the next entry. There is no hidden shuffle unless you create one before FFmpeg starts.
That makes the text file a deterministic record of the broadcast sequence. Someone reviewing it can see which opening, intermission, announcement or closing file is intended to play next. It also makes a night-time failure easier to investigate: compare the file on disk with the order you expected rather than trying to infer the sequence from a long command line.
A practical layout might look like this:
/srv/channel/
├── media/
│ ├── opening.mp4
│ ├── programme-01.mp4
│ ├── programme-02.mp4
│ └── closing.mp4
└── config/
└── playlist.txt
The playlist could then be:
ffconcat version 1.0
file '/srv/channel/media/opening.mp4'
file '/srv/channel/media/programme-01.mp4'
file '/srv/channel/media/programme-02.mp4'
file '/srv/channel/media/closing.mp4'
Keep a copy of the intended order in your normal change process, but do not copy the stream key alongside it. The playlist is useful documentation. The credential should have a narrower audience and a separate replacement procedure.
If you update the list while a broadcast is running, do not assume the currently running FFmpeg process will reread it immediately. The process may already have opened the next input, depending on how it is operating. Make the change deliberately, validate the files, and restart or reload the job according to the service setup you have tested.
The same principle applies if you run more than one channel. A workflow for running two or three 24/7 channels without losing track can help you separate each channel’s media, playlist and credentials. The important point here is not a particular directory naming scheme. It is avoiding one shared configuration file that makes it unclear which key belongs to which channel.
Run FFmpeg with the concat demuxer
Use the concat demuxer by placing -f concat before the input and enabling safe path handling when your playlist uses absolute paths:
ffmpeg -f concat -safe 0 -i /srv/channel/config/playlist.txt \
-c copy -f flv \
rtmps://example.youtube-endpoint.example/live2/REPLACE_WITH_KEY
The endpoint shown here is illustrative. Use the stream URL supplied by YouTube for your channel rather than copying an endpoint from an unrelated example. Keep the key out of scripts, documentation and shell transcripts where practical, and verify the way your chosen process supervisor supplies secrets before adopting a production command.
-f concat tells FFmpeg to use the concat demuxer rather than treating the text file as a video input. -safe 0 permits paths that the demuxer’s safe-path checks might otherwise reject, including many absolute paths. It also means you should control who can edit the playlist, because the FFmpeg process is being allowed to open the paths it is given.
-i identifies the playlist as the input. -c copy requests stream copy, meaning FFmpeg should pass the audio and video packets through instead of decoding and encoding them again. The output format in this example is FLV, commonly used for RTMP-style live publishing. The rtmps scheme indicates an encrypted RTMP connection, but it does not make the credential safe in every place it may be stored or exposed locally.
Test the command with a short, non-production sequence before pointing it at your public channel. Confirm that each path can be read, that the process user has the necessary permissions and that FFmpeg reaches the intended destination. Start with output that is easy to observe, then test the actual service arrangement used for the overnight run.
Do not treat a successful start as proof that the playlist will run indefinitely. Watch for transitions between files, audio loss, timestamp warnings and reconnect behaviour. Your bitrate guide for a 24/7 YouTube live stream is useful for the delivery side, but bitrate advice cannot make incompatible input files safe for stream copy.
When stream copy can work
Stream copy can work when the inputs have compatible stream layouts and timing characteristics. In practical terms, the video streams need to agree on important properties such as codec, dimensions, pixel format and frame-rate behaviour, while the audio streams need compatible codec, sample format, sample rate, channel layout and related parameters. The exact outcome also depends on the containers, timestamps and the FFmpeg build.
For example, a set of files produced by the same export process may have matching H.264 video and AAC audio layouts. If their timestamps and container details are also suitable, -c copy can join them without the extra CPU use and quality change of re-encoding.
That is a conditional result, not a guarantee for every set of MP4 files. Two files can both be labelled MP4 while carrying different codecs, dimensions or audio layouts. One file may be 1920 by 1080 with stereo audio and another may be 1280 by 720 with a different audio sample rate. The names and extensions do not establish compatibility.
Stream copy has useful trade-offs:
| Choice | What happens | Main trade-off |
|---|---|---|
| Stream copy | Existing packets are passed through | Low processing demand, but inputs must be compatible |
| Re-encode video and audio | FFmpeg decodes and creates a common output | More processing and another generation step, but greater control over the output |
| Prepare files before streaming | Inputs are normalised in advance | Extra preparation, but the live process is easier to reason about |
If the files are compatible, stream copy avoids unnecessary generation loss and can reduce the work required from a small VPS. If they are not, forcing the option may produce errors, failed transitions, timestamp problems or an output that YouTube cannot accept consistently.
A deterministic playlist does not solve an incompatible media set. It only determines which file is attempted next. Likewise, RTMPS protects the connection while it is carrying the feed; it does not change the codecs or timing inside that feed.
Check stream layouts, codecs and time bases
Inspect every input before relying on stream copy. ffprobe is the usual companion tool for reading media metadata without playing the file. A compact inspection command is:
ffprobe -v error \
-show_entries stream=index,codec_type,codec_name,width,height,pix_fmt,\
sample_rate,channels,channel_layout,avg_frame_rate,time_base \
-of json /srv/channel/media/programme-01.mp4
Run the same inspection for the other files and compare the results. Do not focus only on codec_name. Check whether each file has the same number and order of streams, whether the video dimensions and pixel format match, and whether the audio channel layout is consistent. A file with an attached subtitle stream or an extra data stream may also require a deliberate mapping decision.
Time bases and timestamps deserve attention because live concatenation is about more than matching labels. Each stream has a time base used to represent packet timing. If one file starts at an unusual timestamp or has discontinuities, the transition may not behave as expected even when the codecs appear identical.
Frame-rate reporting can also be misleading if you compare only a rounded display value. A constant-frame-rate source and a variable-frame-rate source may both appear to be around the same rate while carrying different timing behaviour. Inspect the files, then test a short concatenation rather than trusting a visual guess.
You should also check the first and last seconds of each file. A file can have valid metadata but contain a fade, silence, black frames or a damaged ending that becomes obvious only at the transition. For a devotional loop, for example, a short silence may be intentional in one recording and an encoding error in another.
The check must be performed as the same user that will run the stream, or at least against the same paths and permissions. A technically valid input is still unusable if the FFmpeg process cannot read it. If the files live on mounted storage, confirm that the mount is available before the streaming service starts.
Keep the inspection results with the media preparation record rather than with the stream key. That gives you evidence about why a file was accepted or rejected without increasing the number of places where the credential might be copied.
Re-encode when inputs are incompatible
When the inputs do not share a workable layout, re-encode them to a common format before sending the output. You can either normalise each source as a preparation step or ask the live FFmpeg process to decode and encode the combined output. The first approach adds preparation work but makes the overnight command simpler. The second keeps the workflow in one command but requires the VPS to perform the work continuously.
A general re-encoding pattern might look like this:
ffmpeg -f concat -safe 0 -i /srv/channel/config/playlist.txt \
-c:v libx264 -c:a aac \
-f flv rtmps://example.youtube-endpoint.example/live2/REPLACE_WITH_KEY
This is a pattern, not a universal YouTube preset. Choose the video dimensions, frame rate, audio settings and bitrate after checking your sources and YouTube’s current guidance. Re-encoding cannot repair a missing or badly damaged input, and the command may need explicit filters or mapping when files differ substantially.
Re-encoding also changes the resource calculation. A VPS that can copy packets may not have enough CPU to encode high-resolution video continuously. Test the complete playlist, including the largest or most complex input, while observing CPU use, memory pressure and output stability. Do not infer overnight capacity from a short idle test.
If your channel consists of recordings made on different phones, cameras or editing applications, normalisation before upload is often easier to manage. Establish one target layout, convert the sources, inspect the converted files and then use the concat playlist for the live run. Keep the original recordings separately so that a later conversion does not destroy your source material.
Do not re-encode merely because a file has a different name. First inspect it. Conversely, do not insist on stream copy because it uses less CPU when the transitions are unreliable. A predictable broadcast is worth more than a nominally simpler command.
A cloud workflow can remove the need to keep a VPS running, but it does not remove the need to prepare compatible media. StreamNeo is useful when the specific pain is keeping a prepared file streaming while your own computer is switched off and the run is monitored and restarted automatically, rather than maintaining the FFmpeg process yourself.
Send the output to YouTube Live safely
YouTube’s normal encoder workflow uses a stream URL and a stream key from Live Control Room. Enter the URL in the encoder’s server field and the key in its stream-key field. For FFmpeg, the equivalent values are supplied through the publishing destination, but you should verify how your operating system and service manager handle that value before putting the command into production.
FFmpeg documents RTMPS as RTMP over an encrypted SSL connection in its protocol documentation. That is a statement about protection in transit between FFmpeg and the destination. It does not prove that the key is protected in a shell history, process inspection view, log file, backup, deployment record or readable configuration file.
Because the reviewed official documentation does not establish one VPS-specific secret-storage or runtime-injection method for every operating system, avoid presenting a particular environment variable, service-manager feature or file layout as automatically secure. Check the documentation for the target OS, the service manager and the hosting environment. Consider who can read the secret, whether it can appear in logs or process inspection, how you will rotate it and what happens to backups.
Use a dedicated channel account or carefully limited channel access where appropriate, and restrict VPS administration to trusted people. Keep the playlist, media files and credential handling under separate permissions where your environment permits it. Record the procedure for replacing the key without recording the key itself.
If you suspect exposure, stop treating the existing key as trustworthy. In Live Control Room, use the key’s reset control, then replace the configured value in the encoder or service. YouTube says an owner or manager can reset a key. Check the current YouTube Help instructions for stream keys before carrying out the change, because the interface and account roles may change.
After rotation, confirm that the old process is no longer publishing and that the new process uses the replacement credential. Check the live preview and the first transition between playlist entries. If the broadcast fails after rotation, distinguish authentication failure from a missing file, incompatible input or VPS resource problem rather than immediately generating another key.
If your channel uses recorded material, keep operational checks separate from audience and monetisation questions. The guide to keeping a 24/7 stream eligible for monetisation with repeated videos addresses a different part of the workflow. It does not replace YouTube’s current rules or solve credential exposure.
Before committing, compare the operating options on the pricing page. When the file and channel are ready, start free — 24-hour trial, no card.
FAQ
Is a concat playlist a YouTube playlist?
No. FFmpeg’s concat playlist is a local text file containing file directives. It tells FFmpeg which media files to open and in what order; it does not download or read media from a YouTube playlist.
Can I use -c copy with any MP4 files?
No. The files need compatible stream layouts, codecs, timing and related properties. Inspect them with ffprobe and test the transitions; re-encode to a common layout when stream copy is not reliable.
Does RTMPS protect my stream key on the VPS?
RTMPS protects the connection while FFmpeg sends the feed. It does not by itself protect the key wherever it is stored, supplied to the process or exposed through local access and operational records.
What should I do if the key may have leaked?
Reset it in YouTube Live Control Room, then replace the value used by the FFmpeg job. YouTube documents this reset route for an owner or manager, so check the current Help page and confirm that the old publishing process has stopped.