Use a server-side token proxy

Keep the DRM License Token behind your own backend while preserving native DRM challenges and license response bytes.

View Markdown Live examplesUpdated 2026-09-05

How playback is authorized

Your backend decides who can watch. DRM-X provides playback authorization. The player uses that authorization to request a DRM license.

Viewer
Signs in to your service and requests a video.
Your backend
Checks the user's purchase, subscription, or other permission to watch.
DRM-X
Applies the selected playback rules and returns the playback configuration and authorization.
Player
Uses the returned authorization to request the DRM license needed for playback.

Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.

Advanced server boundary

Keep the DRM License Token behind your own proxy#

Direct-token mode is simplest. Token-proxy mode keeps the real token server-side and returns an opaque, random, expiring handle plus customer-controlled license, FairPlay certificate, and release URLs.

{
  "drm": {
    "integrationMode": "token-proxy",
    "licenseServerUrl": "/api/drmx/license-proxy?kind=license&drm=widevine",
    "authorization": {
      "headerName": "Authorization",
      "scheme": "Bearer",
      "value": "opaque-random-customer-handle"
    }
  },
  "release": {
    "url": "/api/drmx/playback-release",
    "method": "POST",
    "authorization": {
      "headerName": "Authorization",
      "scheme": "Bearer",
      "value": "opaque-random-customer-handle"
    }
  }
}

Bind the handle to the authenticated customer session, Content ID, DRM system, and upstream token expiry. Store it only in a bounded expiring cache, cap request bodies, reject redirects, proxy exact binary challenge/response bytes, and erase it on release or expiry.

The live PHP sample implements both direct-token and token-proxy modes.