SharePoint Brand Center CDN: How does the authentication works

It appears that Microsoft has not published a dedicated security diagram specifically for the Office 365 CDN. However, relevant information can be found toward the bottom of the page linked below.

https://learn.microsoft.com/en-us/sharepoint/modern-experience-performance#microsoft-365-content-delivery-network-cdn

Private origins within the Microsoft 365 CDN provide private access to user content such as SharePoint document libraries, sites and media such as videos. Access to content in private origins is secured with dynamically generated tokens so it can only be accessed by users with permissions to the original document library or storage location. Private origins in the Microsoft 365 CDN can only be used for SharePoint content, and you can only access assets through redirection from your SharePoint environment.