You need your own server (running somewhere other than on a Roku device) to generate the secure token by taking the MD5 hash of your API key, the timestamp, and the scope. The server returns the secure token in a response to your client (Roku) request. The client then includes the secure token in the video playback URL.
However...
You could conceivably generate the secure token within your client application (Roku channel). Livestream doesn't want you doing that to prevent a user gaining access to the API key from the client application. But since the Roku is not a web browser, the API key wouldn't be exposed, so I don't see a problem with doing it from within a Roku channel.
https://github.com/belltown/