# How Multi-DRM works

Understand DRM-X 6.0 Multi-DRM concepts, supported DRM systems, CENC and CBCS formats, content identity, and single-key versus multi-key protection.

Canonical: https://docs.drm-x.com/concepts/how-drm-works
Updated: 2026-09-05

![Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.](https://docs.drm-x.com/assets/media-license-flow.svg)Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.

## What Multi-DRM means[#](#what-multi-drm-means)

Browsers and operating systems do not all use the same content-decryption module. A Multi-DRM service packages compatible encrypted outputs, selects a device-supported DRM, authorizes the viewer once in your backend, and routes the native license challenge to the correct provider.

| DRM | Typical clients | Protected delivery | 
| --- | --- | --- |

| Widevine | Chrome, Android, Android TV, Fire TV | DASH/CENC | 

| PlayReady | Microsoft Edge, Windows, compatible TVs | DASH/CENC | 

| FairPlay Streaming | Safari, iPhone, iPad, Apple TV | HLS/CBCS | 

| WisePlay | Compatible Huawei devices and browsers | Registered qualified output | 



## Stable Content ID, registered manifests[#](#stable-content-id-registered-manifests)

Your business references a stable Content ID. A Published protected file owns its authoritative manifest variants and key model. During session creation DRM-X chooses the registered output for the requested DRM and platform capabilities; the client cannot substitute a different manifest.



## Choose the key model before packaging[#](#choose-the-key-model-before-packaging)

Compatibility

### Single Key Protection

One presentation key and one `ALL` policy rule. Use it when the broadest four-platform compatibility matters more than per-tier key isolation.

Premium tiers

### Multi-key Quality Tiered

Separate AUDIO, SD, HD, UHD1, and UHD2 scopes. Omitted tiers receive no key, and stronger tiers can require stronger security or output protection.

The DRM-X player detects the published key model and recommends the matching policy editor automatically.



## Control plane and data plane[#](#control-plane-and-data-plane)

The control plane manages environments, content, key sets, immutable package releases, registered storage, API clients, policies, and audit evidence. The data plane creates short-lived playback sessions and transports native certificate, license, renewal, and release traffic.

**Your backend remains authoritative**DRM-X does not replace your customer, order, course, or subscription database. It enforces the bounded decision your authenticated server makes.



Architecture 

## One flow for browsers, applications, and TVs[#](#one-flow-for-browsers-applications-and-tvs)



```
Viewer signs in to your service
→ Your backend checks purchase / subscription / course access
→ Your backend selects a named template or complete custom policy
→ POST api6.drm-x.com/api/v1/playback/environments/{siteId}/sessions
→ DRM-X resolves the active published package and registered manifest
→ DRM-X returns Contract v1 + short-lived DRM License Token
→ Player sends the opaque DRM challenge to the returned license URL
→ DRM-X Gateway validates the token and provider enforces its signed policy
→ Player releases the concurrent-stream reservation on stop or replacement
```





Control plane

### Packaging and configuration

Content, key sets, immutable package releases, registered manifests, API clients, defaults, credentials, and audit evidence.



Data plane

### Playback and licenses

Short-lived session authorization, DRM License Tokens, license challenges, FairPlay certificates, renewals, and session release.



DRM-X does not become your entitlement database. It receives the decision made by your authenticated backend and signs that request-time decision. Never generate authorization in browser JavaScript, Android code, or an iOS application.





Foundations 

## Concepts and supported delivery formats[#](#concepts-and-supported-delivery-formats)




| DRM | Typical clients | Published media | Key system | 
| --- | --- | --- | --- |

| Widevine | Chrome, Firefox, Android, Android TV, Fire TV | DASH + CENC | `com.widevine.alpha` | 

| PlayReady | Microsoft Edge on qualified Windows devices | DASH + CENC | `com.microsoft.playready.recommendation` | 

| FairPlay Streaming | Safari, iPhone, iPad, Apple TV | HLS + CBCS | `com.apple.fps` | 

| WisePlay | Compatible Huawei browsers and devices | DASH + CENC | `com.huawei.wiseplay` | 


### Single Key Protection



One key protects the presentation. It maximizes four-platform compatibility, but resolution tiers cannot be cryptographically separated. Use one uniform `ALL` security rule and `maximumQualityTier: "auto"`.



### Multi-key Quality Tiered



Distinct `AUDIO`, `SD`, `HD`, `UHD1`, and optional `UHD2` keys permit different security requirements. A missing rule denies that tier. Use this when UHD must require hardware DRM or stronger output protection.