License authorization overview

Use the Playback Session API after your backend has checked permission to watch. Choose playback rules, connect the player, and release the session when playback ends.

View Markdown Live examplesUpdated 2026-09-05

How playback is authorized

Your backend decides who can watch. DRM-X provides playback authorization. The player uses that authorization to request a DRM license.

Viewer
Signs in to your service and requests a video.
Your backend
Checks the user's purchase, subscription, or other permission to watch.
DRM-X
Applies the selected playback rules and returns the playback configuration and authorization.
Player
Uses the returned authorization to request the DRM license needed for playback.

Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.

Create a playback session#

POST https://api6.drm-x.com/api/v1/playback/environments/{siteId}/sessions
Accept: application/json
Content-Type: application/json
X-DRMX-Client-Id: {siteKey}
X-DRMX-Client-Secret: {accessKey}

{
  "contentId": "course-12-lesson-4",
  "contentType": "vod",
  "drmSystem": "widevine",
  "subject": "customer-user-1001",
  "sessionId": "new-unpredictable-id-per-playback",
  "playbackMode": "streaming",
  "licensePolicyTemplate": "multi-tier-standard",
  "useEnvironmentDefaults": true,
  "applicationId": "customer-web"
}

All values come from trusted server state except detected client capability. Validate capability input against an allowlist and never accept entitlement, policy, or URLs from the client.

Choose a named policy template#

Template	Use it for
`single-software`	Single-key content with broad software-decryption compatibility.
`single-hdcp`	Single-key content that also requires approved digital output protection.
`single-hardware`	Single-key premium playback on qualified hardware-secure devices.
`multi-tier-standard`	Multi-key content with separate AUDIO, SD, HD, and UHD rules.

For custom policy, send one complete approved DRM-X License Policy JSON v2 from your server. Choose licensePolicyTemplate or licensePolicy, never both.

Direct token or customer proxy#

Direct-token

The fastest integration. The client receives a short-lived DRM License Token and attaches it only to the returned license or FairPlay certificate endpoint.

Token-proxy

Your server stores the real token in a bounded expiring cache and returns an opaque handle with customer-controlled proxy URLs. Bind the handle to the user, Content ID, DRM, and expiry.

Complete the lifecycle#

Return the session response with Cache-Control: no-store.
Use exact binary pass-through for native DRM challenge and response bodies.
Reject redirects and cap certificate, license, and log request sizes.
Call the returned release route on Stop, replacement, terminal error, and shutdown.
Never log authorization headers, successful session bodies, license bytes, challenges, or content keys.