The Overlay URL is a credential, not a public page
Anyone who can read the full URL can request the current Overlay state. OBS does not add a second login in front of that key.
Never leave the URL in a screenshot, VOD, tutorial window, QR code, or shared scene collection. Cover the query string before asking for help.
Each plan allows 1 active link
Free, trial, and Pro all cap unrevoked Overlay links at 1. Creating a replacement is how you rotate the credential, not how you mint a second public page.
Old PCs, backups, and guest machines keep dead URLs. If you cannot list every place the key was stored, revoke it.
Layout lives on the account Overlay, not on the leaked URL
player-single, player-multi, lyrics-3d, fonts, and colors belong to the signed-in Overlay. Rotating the URL does not reset those controls.
You still have to paste the new URL into OBS. The old Browser Source cannot follow a credential that no longer exists.
Rotation is not finished until the old URL fails
After revoke, paste the replacement into the existing Browser Source and refresh it. Then open the old URL privately and confirm it no longer shows playback.
If the old address still works, revocation did not complete. Do not go live until it fails.
Step-by-step setup
- 01Revoke the exposed credential in the account
Invalidation is the first action. Restyling the Overlay does not hide a leaked key.
- 02Copy the replacement once
Only 1 active link is allowed. Store it privately; do not put it on stream.
- 03Paste the new URL into the existing Browser Source
Keep crop and position. Refresh the source after the paste.
- 04Confirm the revoked URL no longer shows playback
Rotation is incomplete if the old address still loads lyric state.
Frequently asked questions
Can I recover a revoked Overlay link?
No. Create a new link and update OBS.
Is the Overlay key safe to show in a screenshot?
No. Remove the query string or cover the entire URL before sharing an image.
Does revoke reset player-multi or 3D settings?
No. Layout stays on the account Overlay. OBS still needs the new URL pasted in.