Your first protected video

Start DRM-X 6.0 protected Web playback: publish content, create least-privilege credentials, authorize a viewer, and load the registered manifest.

View Markdown Live examplesUpdated 2026-09-05

From your first video to protected playback

Encrypt a video, connect your backend, and test playback. Keep your Access Key on the server.

Sign in
Open DRM-X Console and select your environment.
Encrypt and publish
Package your video and wait until its status is Published.
Create an API client
Grant only the license-tokens:create permission. Save the Access Key securely when it is shown.
Configure your backend
Set the credentials and Content ID, choose playback rules, and check whether the user is allowed to watch.
Test playback
Request a playback session through your backend. The player then requests a DRM license and plays the encrypted video.

Encrypt and publish a video, configure your backend, and test playback with a compatible player.

1. Publish one protected file#

Choose an environment.Use Development while integrating, then create separate Production credentials.
Open Package content.Choose Single Key for broad compatibility or Multi-key Quality Tiered for separate AUDIO, SD, HD, and UHD controls.
Wait for Published.Copy its Content ID. At playback, DRM-X resolves the registered DASH or HLS manifest; customers do not supply arbitrary manifest URLs.

2. Create a least-privilege server integration#

In Console → Integrations, create a Playback API client with only license-tokens:create. Copy Site ID, Site Key, and the one-time Access Key. Keep all three on your server; never put the Access Key in JavaScript, an APK, an IPA, or a TV app.

Production recommendationThe samples allow direct code values for a fast first run. Before production, move the Access Key into your secret manager or protected environment configuration and rotate any value that was exposed.

3. Change the three marked server settings#

// Server-side only
siteId: "your-development-environment-uuid"
siteKey: "drmx_your_environment_scoped_client_id"
accessKey: "paste-the-one-time-access-key"

contentId: "your-published-content-id"
licensePolicyTemplate: "multi-tier-standard"

Then replace the sample login and entitlement function with your real session, subscription, purchase, course enrollment, rental, or event-access check.

4. Request playback, then release it#

Create a new unpredictable session ID for each playback attempt. Return the successful session to the client with Cache-Control: no-store. Release the reservation on Stop, replacement, terminal error, and application shutdown.

Never accept subject, policy JSON, manifest URL, or license URL directly from the player.
Allow authorization headers only on the returned DRM license and FairPlay certificate routes.
Record correlation IDs and stage outcomes, never tokens, keys, challenges, or license bytes.