For your first segment in the question, you can create your own management via files.
Write a new line to a file every time you create a "key" for this, for example...
<?php
file_put_contents("sessions.txt", "sjhGtwtha 0", FILE_APPEND);
The '0' here for this instance, means "not used".
Then you can do something like this:
<?php
function isUsed($key) {
$keys = file_get_contents("sessions.txt");
foreach (explode("\n", str_ireplace("\r", "", $keys)) as $line) {
if (substr($line, 0, strlen($key)) == $key) {
return substr($line, strlen($key) + 1, 1) == '1';
}
}
return true; // ID is invalid, never been assigned at all
}
function updateFile($key) {
$keys = file_get_contents("sessions.txt");
foreach (explode("\n", str_ireplace("\r", "", $keys)) as &$line) {
if (substr($line, 0, strlen($key)) == $key)
$line = $key . ' 1';
}
file_put_contents("sessions.txt", implode("\n", $keys));
}
To decide whether it was used.
As for the second part, I'm not sure that's doable. You can try to obfuscate but eventually the browser needs to know what file is going to be played, so it will always at some point, be accessible via digging in the source.