DRM-X 6.0How Multi-DRM works
Learn how Multi-DRM protects your videos, how your backend controls access, and how the player obtains a DRM license.
Encrypted video and DRM licenses follow separate paths
The CDN delivers encrypted video. Your backend checks access, and the DRM license service authorizes decryption on a compatible device.
- Storage / CDN
Delivers encrypted media to the player.
- Your backend
Checks whether the viewer is allowed to watch and requests playback authorization from DRM-X.
- DRM-X
Validates the playback authorization and handles the DRM license request.
- Player + device
Uses the device's DRM system to obtain a license and play the encrypted media.
This guide explains the path from your source file to authorized playback. Start with Your first protected video for the complete setup, or use the illustrated Desktop tutorial to package your first file.
What Multi-DRM means#
Different browsers and devices use different DRM systems. DRM-X brings content encryption, playback authorization and license delivery into one integration. Your backend checks whether a viewer is allowed to watch. DRM-X returns the playback configuration and authorization for a compatible player. The player then requests the DRM license needed to play the encrypted video.
| DRM | Typical clients | Protected delivery |
|---|---|---|
| Widevine | Chrome, Android, Android TV, Fire TV | DASH/CENC |
| PlayReady | Microsoft Edge, Windows, compatible TVs | DASH/CENC |
| FairPlay Streaming | Safari, iPhone, iPad, Apple TV | HLS/CBCS |
| WisePlay | Compatible Huawei devices and browsers | Registered qualified output |
Stable Content ID, registered manifests#
Use the Content ID to identify a video in your application. Each published video has registered playback manifests and an encryption key model. When your backend requests playback, DRM-X selects the matching manifest for the device’s DRM system. The player cannot replace it with an unregistered manifest.
Choose the key model before packaging#
Single Video Key Protection
One video key protects every selected video rendition under one ALL policy rule. Audio is clear by default; enabling audio encryption adds a separate audio key for Safari/FairPlay compatibility.
Multi-key Quality Tiered
Separate AUDIO, SD, HD, UHD1, and UHD2 scopes. Omitted tiers receive no key, and stronger tiers can require stronger security or output protection.
The DRM-X player detects the published key model and recommends the matching policy editor automatically.
Manage content, then authorize playback#
DRM-X has two main jobs. First, it helps you configure content, encryption, storage, and access rules. Then, when a viewer presses Play, it creates a short-lived playback session and handles the DRM license exchange. Developers call these the control plane and the data plane.
One flow for browsers, applications, and TVs#
- Viewer signs in to your service.
- Your backend checks purchase, subscription, or course access.
- Your backend selects a named template or a complete custom policy.
- Your backend creates a playback session:
POST api6.drm-x.com/api/v1/playback/environments/{siteId}/sessions. - DRM-X resolves the active published package and its registered manifest.
- DRM-X returns Contract v1 and a short-lived DRM License Token.
- The player sends the opaque DRM challenge to the returned license URL.
- DRM-X Gateway validates the token, and the provider enforces its signed policy.
- When concurrent-stream enforcement is enabled, the player releases its reservation on stop or replacement.
Packaging and configuration
Content, key sets, immutable package releases, registered manifests, API clients, defaults, credentials, and audit evidence.
Playback and licenses
Short-lived session authorization, DRM License Tokens, license challenges, FairPlay certificates, renewals, and session release.
DRM-X does not become your entitlement database. It receives the decision made by your authenticated backend and signs that request-time decision. Never generate authorization in browser JavaScript, Android code, or an iOS application.
Concepts and supported delivery formats#
| DRM | Typical clients | Published media | Key system |
|---|---|---|---|
| Widevine | Chrome, Firefox, Android, Android TV, Fire TV | DASH + CENC | com.widevine.alpha |
| PlayReady | Microsoft Edge on qualified Windows devices | DASH + CENC | com.microsoft.playready.recommendation |
| FairPlay Streaming | Safari, iPhone, iPad, Apple TV | HLS + CBCS | com.apple.fps |
| WisePlay | Compatible Huawei browsers and devices | DASH + CENC | com.huawei.wiseplay |
Single Video Key Protection
One video key protects all selected video renditions, so resolution tiers cannot be cryptographically separated. Audio is clear by default; encrypted audio uses a separate audio key. Use one uniform ALL security rule and maximumQualityTier: "auto".
Multi-key Quality Tiered
Distinct AUDIO, SD, HD, UHD1, and optional UHD2 keys permit different security requirements. A missing rule denies that tier. Use this when UHD must require hardware DRM or stronger output protection.
Mobile bandwidth and security are separate controls#
A 4K package can contain 480p, 720p, 1080p and 2160p renditions. The optional phone cap requests at most 1080p for phones while desktop and tablet playback keep their existing ceiling. Auto and manual quality selection remain within the authorized result. Packaging still keeps the UHD renditions for other audiences.
The usable resolution is the lowest of the customer limit, source ladder, DRM policy, output protection and decoder support. Single Video Key Protection cannot separate resolution tiers cryptographically. For trusted tier enforcement, use the matching multi-key policy and a backend-owned rule. Read the integration option and test procedure.
Which part does what#
| Part | Responsibility | Result |
|---|---|---|
| Desktop or CLI Packager | Encode the source, encrypt the selected renditions and publish the protected output. | A Published Content ID with registered manifests. |
| Your website backend | Authenticate the viewer, check access and choose trusted content and policy. | An authorized playback-session request. |
| DRM-X | Validate the request and provide the registered manifest, DRM License Token and bounded license routes. | A playback contract for the player and signed DRM enforcement. |
| Universal Player and device DRM | Load protected media, obtain the license and play within the allowed capabilities. | Playback with the permitted quality, audio and subtitles. |
Changing the player UI does not grant more DRM rights. A phone-only resolution cap can reduce the requested ladder, but stronger security requirements belong in your trusted backend and matching DRM policy.