DRM-X 6.0How Multi-DRM works
Learn how Multi-DRM protects your videos, how your backend controls access, and how the player obtains a DRM license.
Encrypted video and DRM licenses follow separate paths
The CDN delivers encrypted video. Your backend checks access, and the DRM license service authorizes decryption on a compatible device.
- Storage / CDN
Delivers encrypted media to the player.
- Your backend
Checks whether the viewer is allowed to watch and requests playback authorization from DRM-X.
- DRM-X
Validates the playback authorization and handles the DRM license request.
- Player + device
Uses the device's DRM system to obtain a license and play the encrypted media.
What Multi-DRM means#
Different browsers and devices use different DRM systems. DRM-X brings content encryption, playback authorization and license delivery into one integration. Your backend checks whether a viewer is allowed to watch. DRM-X returns the playback configuration and authorization for a compatible player. The player then requests the DRM license needed to play the encrypted video.
| DRM | Typical clients | Protected delivery |
|---|---|---|
| Widevine | Chrome, Android, Android TV, Fire TV | DASH/CENC |
| PlayReady | Microsoft Edge, Windows, compatible TVs | DASH/CENC |
| FairPlay Streaming | Safari, iPhone, iPad, Apple TV | HLS/CBCS |
| WisePlay | Compatible Huawei devices and browsers | Registered qualified output |
Stable Content ID, registered manifests#
Use the Content ID to identify a video in your application. Each published video has registered playback manifests and an encryption key model. When your backend requests playback, DRM-X selects the matching manifest for the device’s DRM system. The player cannot replace it with an unregistered manifest.
Choose the key model before packaging#
Single Video Key Protection
One video key protects every selected video rendition under one ALL policy rule. Audio is clear by default; enabling audio encryption adds a separate audio key for Safari/FairPlay compatibility.
Multi-key Quality Tiered
Separate AUDIO, SD, HD, UHD1, and UHD2 scopes. Omitted tiers receive no key, and stronger tiers can require stronger security or output protection.
The DRM-X player detects the published key model and recommends the matching policy editor automatically.
Manage content, then authorize playback#
DRM-X has two main jobs. First, it helps you configure content, encryption, storage, and access rules. Then, when a viewer presses Play, it creates a short-lived playback session and handles the DRM license exchange. Developers call these the control plane and the data plane.
One flow for browsers, applications, and TVs#
- Viewer signs in to your service.
- Your backend checks purchase, subscription, or course access.
- Your backend selects a named template or a complete custom policy.
- Your backend creates a playback session:
POST api6.drm-x.com/api/v1/playback/environments/{siteId}/sessions. - DRM-X resolves the active published package and its registered manifest.
- DRM-X returns Contract v1 and a short-lived DRM License Token.
- The player sends the opaque DRM challenge to the returned license URL.
- DRM-X Gateway validates the token, and the provider enforces its signed policy.
- When concurrent-stream enforcement is enabled, the player releases its reservation on stop or replacement.
Packaging and configuration
Content, key sets, immutable package releases, registered manifests, API clients, defaults, credentials, and audit evidence.
Playback and licenses
Short-lived session authorization, DRM License Tokens, license challenges, FairPlay certificates, renewals, and session release.
DRM-X does not become your entitlement database. It receives the decision made by your authenticated backend and signs that request-time decision. Never generate authorization in browser JavaScript, Android code, or an iOS application.
Concepts and supported delivery formats#
| DRM | Typical clients | Published media | Key system |
|---|---|---|---|
| Widevine | Chrome, Firefox, Android, Android TV, Fire TV | DASH + CENC | com.widevine.alpha |
| PlayReady | Microsoft Edge on qualified Windows devices | DASH + CENC | com.microsoft.playready.recommendation |
| FairPlay Streaming | Safari, iPhone, iPad, Apple TV | HLS + CBCS | com.apple.fps |
| WisePlay | Compatible Huawei browsers and devices | DASH + CENC | com.huawei.wiseplay |
Single Video Key Protection
One video key protects all selected video renditions, so resolution tiers cannot be cryptographically separated. Audio is clear by default; encrypted audio uses a separate audio key. Use one uniform ALL security rule and maximumQualityTier: "auto".
Multi-key Quality Tiered
Distinct AUDIO, SD, HD, UHD1, and optional UHD2 keys permit different security requirements. A missing rule denies that tier. Use this when UHD must require hardware DRM or stronger output protection.