How Multi-DRM works

Learn how Multi-DRM protects your videos, how your backend controls access, and how the player obtains a DRM license.

View Markdown Live examplesUpdated 2026-09-05

Encrypted video and DRM licenses follow separate paths

The CDN delivers encrypted video. Your backend checks access, and the DRM license service authorizes decryption on a compatible device.

Storage / CDN
Delivers encrypted media to the player.
Your backend
Checks whether the viewer is allowed to watch and requests playback authorization from DRM-X.
DRM-X
Validates the playback authorization and handles the DRM license request.
Player + device
Uses the device's DRM system to obtain a license and play the encrypted media.

Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.

What Multi-DRM means#

Different browsers and devices use different DRM systems. DRM-X brings content encryption, playback authorization and license delivery into one integration. Your backend checks whether a viewer is allowed to watch. DRM-X returns the playback configuration and authorization for a compatible player. The player then requests the DRM license needed to play the encrypted video.

DRM	Typical clients	Protected delivery
Widevine	Chrome, Android, Android TV, Fire TV	DASH/CENC
PlayReady	Microsoft Edge, Windows, compatible TVs	DASH/CENC
FairPlay Streaming	Safari, iPhone, iPad, Apple TV	HLS/CBCS
WisePlay	Compatible Huawei devices and browsers	Registered qualified output

Stable Content ID, registered manifests#

Your business references a stable Content ID. A Published protected file owns its authoritative manifest variants and key model. During session creation DRM-X chooses the registered output for the requested DRM and platform capabilities; the client cannot substitute a different manifest.

Choose the key model before packaging#

Compatibility

Single Key Protection

One presentation key and one ALL policy rule. Use it when the broadest four-platform compatibility matters more than per-tier key isolation.

Premium tiers

Multi-key Quality Tiered

Separate AUDIO, SD, HD, UHD1, and UHD2 scopes. Omitted tiers receive no key, and stronger tiers can require stronger security or output protection.

The DRM-X player detects the published key model and recommends the matching policy editor automatically.

Control plane and data plane#

The control plane manages environments, content, key sets, immutable package releases, registered storage, API clients, policies, and audit evidence. The data plane creates short-lived playback sessions and transports native certificate, license, renewal, and release traffic.

Your backend remains authoritativeDRM-X does not replace your customer, order, course, or subscription database. It enforces the bounded decision your authenticated server makes.

Architecture

One flow for browsers, applications, and TVs#

Viewer signs in to your service
  → Your backend checks purchase / subscription / course access
  → Your backend selects a named template or complete custom policy
  → POST api6.drm-x.com/api/v1/playback/environments/{siteId}/sessions
  → DRM-X resolves the active published package and registered manifest
  → DRM-X returns Contract v1 + short-lived DRM License Token
  → Player sends the opaque DRM challenge to the returned license URL
  → DRM-X Gateway validates the token and provider enforces its signed policy
  → Player releases the concurrent-stream reservation on stop or replacement

Control plane

Packaging and configuration

Content, key sets, immutable package releases, registered manifests, API clients, defaults, credentials, and audit evidence.

Data plane

Playback and licenses

Short-lived session authorization, DRM License Tokens, license challenges, FairPlay certificates, renewals, and session release.

DRM-X does not become your entitlement database. It receives the decision made by your authenticated backend and signs that request-time decision. Never generate authorization in browser JavaScript, Android code, or an iOS application.

Foundations

Concepts and supported delivery formats#

DRM	Typical clients	Published media	Key system
Widevine	Chrome, Firefox, Android, Android TV, Fire TV	DASH + CENC	`com.widevine.alpha`
PlayReady	Microsoft Edge on qualified Windows devices	DASH + CENC	`com.microsoft.playready.recommendation`
FairPlay Streaming	Safari, iPhone, iPad, Apple TV	HLS + CBCS	`com.apple.fps`
WisePlay	Compatible Huawei browsers and devices	DASH + CENC	`com.huawei.wiseplay`

Single Key Protection

One key protects the presentation. It maximizes four-platform compatibility, but resolution tiers cannot be cryptographically separated. Use one uniform ALL security rule and maximumQualityTier: "auto".

Multi-key Quality Tiered

Distinct AUDIO, SD, HD, UHD1, and optional UHD2 keys permit different security requirements. A missing rule denies that tier. Use this when UHD must require hardware DRM or stronger output protection.