Integration kit

The language-independent request

POST /api/v1/playback/environments/{siteId}/sessions
X-DRMX-Client-Id: {siteKey}
X-DRMX-Client-Secret: {accessKey}

{
  "contentId": "trusted-content-id",
  "contentType": "vod",
  "drmSystem": "widevine",
  "subject": "authenticated-user-id",
  "sessionId": "new-id-for-this-attempt",
  "licensePolicyTemplate": "multi-tier-standard",
  "useEnvironmentDefaults": true
}

Choose your backend

PHP 8.2+

Use cURL with JSON exceptions, HTTPS-only protocols, a 12-second timeout, and explicit response-status handling. The complete PHP app includes login, entitlement, direct-token, token-proxy, diagnostics, and release.

Run PHP sample

ASP.NET Core

Use the runnable ASP.NET Core sample with server environment variables, a validated HttpClient endpoint and your application entitlement service. ASP.NET Framework has a separate Windows/IIS example.

Node.js / TypeScript

Use fetch with AbortSignal.timeout, server-only configuration, response schema validation, and Cache-Control: no-store.

Python 3.11+

Use an HTTPS client with explicit timeouts, JSON serialization, status checks, and secret injection from the production runtime.

Java 21+

Use HttpClient with request timeout, exact credential headers, validated JSON, and no redirects to untrusted origins.

Go or Ruby

Use a request context/timeout, exact JSON fields, strict status checks, and never print credential or successful playback response bodies.

Map business values safely

Request fieldSource
contentIdServer mapping from your catalog to a Published protected file.
subjectYour authenticated user ID; never a browser-provided identity.
licensePolicyTemplateServer mapping from trusted plan, rental, course, or content tier.
drmSystemValidated client capability, limited to DRM systems your integration supports.
sessionIdFresh unpredictable identifier created by your backend for this playback attempt.

Keep credentials in server configuration

The PHP example includes editable server configuration; the ASP.NET examples use environment variables. For production, use your host secret manager and grant only license-tokens:create.

Server tutorials

In every example, authenticate the viewer and check entitlement before this call. Configure credentials on the server, follow the matching platform guide, and never log request headers or successful playback response bodies.

PHP 8.2+
$drmx = [
    'platformApi' => 'https://api6.drm-x.com',
    'siteId' => 'your-development-environment-uuid',
    'siteKey' => 'drmx_your_environment_scoped_client_id',
    'accessKey' => 'paste-your-one-time-access-key',
];

$payload = [
    'contentId' => $trustedContentId,
    'contentType' => 'vod',
    'drmSystem' => $drmSystem,
    'subject' => $authenticatedUserId,
    'playbackMode' => 'streaming',
    'licensePolicyTemplate' => 'multi-tier-standard',
    'useEnvironmentDefaults' => true,
    'maximumQualityTier' => 'auto',
];

$curl = curl_init($drmx['platformApi'] . '/api/v1/playback/environments/' .
    rawurlencode($drmx['siteId']) . '/sessions');
curl_setopt_array($curl, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode($payload, JSON_THROW_ON_ERROR),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 12,
    CURLOPT_PROTOCOLS => CURLPROTO_HTTPS,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Content-Type: application/json',
        'X-DRMX-Client-Id: ' . $drmx['siteKey'],
        'X-DRMX-Client-Secret: ' . $drmx['accessKey'],
    ],
]);
$body = curl_exec($curl);

Start from the complete executable sample; it includes login, entitlement, direct-token mode, token-proxy mode, bounded diagnostics, and release handling.

Node.js / TypeScript
const response = await fetch(
  `${process.env.DRMX_PLATFORM_API}/api/v1/playback/environments/${
    encodeURIComponent(process.env.DRMX_PLAYBACK_SITE_ID!)
  }/sessions`,
  {
    method: "POST",
    headers: {
      "Accept": "application/json",
      "Content-Type": "application/json",
      "X-DRMX-Client-Id": process.env.DRMX_PLAYBACK_SITE_KEY!,
      "X-DRMX-Client-Secret": process.env.DRMX_PLAYBACK_ACCESS_KEY!,
    },
    body: JSON.stringify({
      contentId: trustedContentId,
      contentType: "vod",
      drmSystem,
      subject: authenticatedUser.id,
      playbackMode: "streaming",
      licensePolicyTemplate: "multi-tier-standard",
      useEnvironmentDefaults: true,
      maximumQualityTier: "auto",
    }),
    signal: AbortSignal.timeout(12_000),
  },
);
const playback = await response.json();
Python 3.11+
import json, os, urllib.request

payload = json.dumps({
    "contentId": trusted_content_id,
    "contentType": "vod",
    "drmSystem": drm_system,
    "subject": authenticated_user_id,
    "playbackMode": "streaming",
    "licensePolicyTemplate": "multi-tier-standard",
    "useEnvironmentDefaults": True,
    "maximumQualityTier": "auto",
}).encode("utf-8")

url = (
    os.environ["DRMX_PLATFORM_API"] +
    "/api/v1/playback/environments/" +
    os.environ["DRMX_PLAYBACK_SITE_ID"] + "/sessions"
)
request = urllib.request.Request(url, data=payload, method="POST", headers={
    "Accept": "application/json",
    "Content-Type": "application/json",
    "X-DRMX-Client-Id": os.environ["DRMX_PLAYBACK_SITE_KEY"],
    "X-DRMX-Client-Secret": os.environ["DRMX_PLAYBACK_ACCESS_KEY"],
})
with urllib.request.urlopen(request, timeout=12) as response:
    playback = json.load(response)
ASP.NET Core / C#
builder.Services.AddDrmXPlayback(options =>
{
    options.PlatformApi = "https://api6.drm-x.com";
    options.SiteId = Environment.GetEnvironmentVariable("DRMX_PLAYBACK_SITE_ID") ?? "";
    options.SiteKey = Environment.GetEnvironmentVariable("DRMX_PLAYBACK_SITE_KEY") ?? "";
    options.AccessKey = Environment.GetEnvironmentVariable("DRMX_PLAYBACK_ACCESS_KEY") ?? "";
    options.ApplicationId = "customer-aspnet-website";
    options.LicensePolicyTemplate = "multi-tier-standard";
});

var payload = new {
    contentId = trustedContentId,
    contentType = "vod",
    drmSystem,
    subject = authenticatedUserId,
    playbackMode = "streaming",
    licensePolicyTemplate = "multi-tier-standard",
    useEnvironmentDefaults = true,
    maximumQualityTier = "auto"
};

using var request = new HttpRequestMessage(HttpMethod.Post,
    $"{platformApi}/api/v1/playback/environments/{Uri.EscapeDataString(siteId)}/sessions") {
    Content = JsonContent.Create(payload)
};
request.Headers.Add("X-DRMX-Client-Id", siteKey);
request.Headers.Add("X-DRMX-Client-Secret", accessKey);
using var response = await httpClient.SendAsync(request, cancellationToken);
Java 21 / Spring services
String payload = objectMapper.writeValueAsString(Map.of(
    "contentId", trustedContentId,
    "contentType", "vod",
    "drmSystem", drmSystem,
    "subject", authenticatedUserId,
    "playbackMode", "streaming",
    "licensePolicyTemplate", "multi-tier-standard",
    "useEnvironmentDefaults", true,
    "maximumQualityTier", "auto"
));

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create(platformApi + "/api/v1/playback/environments/" +
        URLEncoder.encode(siteId, StandardCharsets.UTF_8) + "/sessions"))
    .timeout(Duration.ofSeconds(12))
    .header("Accept", "application/json")
    .header("Content-Type", "application/json")
    .header("X-DRMX-Client-Id", siteKey)
    .header("X-DRMX-Client-Secret", accessKey)
    .POST(HttpRequest.BodyPublishers.ofString(payload))
    .build();
HttpResponse<String> response = client.send(request,
    HttpResponse.BodyHandlers.ofString());
Go 1.23+
payload, _ := json.Marshal(map[string]any{
    "contentId": trustedContentID,
    "contentType": "vod",
    "drmSystem": drmSystem,
    "subject": authenticatedUserID,
    "playbackMode": "streaming",
    "licensePolicyTemplate": "multi-tier-standard",
    "useEnvironmentDefaults": true,
    "maximumQualityTier": "auto",
})

url := platformAPI + "/api/v1/playback/environments/" +
    url.PathEscape(siteID) + "/sessions"
req, _ := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(payload))
req.Header.Set("Accept", "application/json")
req.Header.Set("Content-Type", "application/json")
req.Header.Set("X-DRMX-Client-Id", siteKey)
req.Header.Set("X-DRMX-Client-Secret", accessKey)
response, err := httpClient.Do(req)
Ruby 3.3+
uri = URI("#{ENV.fetch('DRMX_PLATFORM_API')}/api/v1/playback/environments/" \
          "#{ERB::Util.url_encode(ENV.fetch('DRMX_PLAYBACK_SITE_ID'))}/sessions")
request = Net::HTTP::Post.new(uri)
request['Accept'] = 'application/json'
request['Content-Type'] = 'application/json'
request['X-DRMX-Client-Id'] = ENV.fetch('DRMX_PLAYBACK_SITE_KEY')
request['X-DRMX-Client-Secret'] = ENV.fetch('DRMX_PLAYBACK_ACCESS_KEY')
request.body = JSON.generate(
  contentId: trusted_content_id,
  contentType: 'vod',
  drmSystem: drm_system,
  subject: authenticated_user_id,
  playbackMode: 'streaming',
  licensePolicyTemplate: 'multi-tier-standard',
  useEnvironmentDefaults: true,
  maximumQualityTier: 'auto'
)
response = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |http| http.request(request) }

Integration source downloads · ASP.NET Core integration · Node.js + Express integration

ASP.NET Framework integration