Protect Streams Utility
Protect Streams Utility FAQ
Details on how the utility behaves in practice, beyond the short FAQ on the main product page.
- Should I paste the plain (rtsp://…:7447) or secure (rtsps://…:7441) stream URL?
-
The secure URL on port 7441 (
rtsps://…) works in most modern consumers and is the one to try first if you're not sure. The plain URL on port 7447 (rtsp://…) exists for older or third-party gear that can't negotiate TLS. If a device won't connect with the secure URL, fall back to the plain one. - What do the token statuses (Stable, Rotated, New) mean?
- They describe the state of a camera's stream token relative to what you last copied. Stable means the token hasn't changed since your last export. New means the utility hasn't seen a token for that camera before. Rotated means the token changed, most often because someone hit Force Re-Enable on that camera in the console, which rotates its stream token and invalidates any URL built from the old one. If you see Rotated, re-run the utility and re-copy the URL; the old one will no longer work.
- What do the snapshot statuses (on, off, unsupported, offline) mean?
- On and off reflect whether anonymous snapshot is currently enabled for that camera. Offline means the utility couldn't reach the camera at all. Unsupported means the camera can't do anonymous snapshot; this is expected for third-party ONVIF cameras, which don't support the feature, not a bug in the utility.
- Where do I find a camera's Recovery Code?
- In the camera's Manual Recovery section of the Protect console. Screenshots of the exact location are coming in the how-to guide once we've shot them against a live console.
- Why can't I log in with my UniFi SSO / MFA account?
- Cloud SSO with multi-factor authentication isn't something the utility can script through; there's no way to automate an MFA prompt safely. The optional enrichment login (used for the extra data an API key alone can't provide) needs a local-only admin user on the console instead of your cloud SSO account.
- Is my API key sent anywhere?
-
No. The utility talks directly from your desktop to your
Protect console; nothing is sent to SynDrivers, and the app
collects no telemetry. By default the key is held in memory for
the session only. If you turn on Saved sites
and save a console, the key (and the optional UniFi password)
is stored on that PC encrypted with Windows Data Protection
(DPAPI), readable only by your Windows account; the site name
and host are stored in plain text. Everything lives under
%LOCALAPPDATA%\ProtectStreamsUtility; delete a saved site in the app, or delete that folder, to remove it. If you export your results to share with support or a colleague, the export can redact the key. - Why is the download ~149 MB, and why does Windows SmartScreen warn me?
- The utility ships as a self-contained single-file .NET build, so you don't need to install a separate runtime first, and that's most of the size. The build is currently unsigned; code signing is in progress and expected within weeks. Until then, Windows SmartScreen will show an unknown-publisher warning on first run. Click More info → Run anyway to proceed.
Setting it up for the first time? Read the how-to guide →