Apple FairPlay integration

Integrate DRM-X 6.0 FairPlay Streaming on iOS, iPadOS, tvOS, and Safari using Swift, AVFoundation, SPC and CKC exchange, and secure server authorization.

View Markdown Live examplesUpdated 2026-09-05

FairPlay certificate and license exchange

Keep the SPC and CKC binary data unchanged throughout the exchange.

Certificate
Load the application certificate from the authorized URL.
SPC
Use the certificate and HLS identifier to create the device's SPC request.
CKC
Send the SPC to the authorized license URL and receive the CKC response.
AVFoundation
Pass the CKC to AVFoundation to play the encrypted video.

Certificate → SPC challenge → CKC response → native playback. Keep binary challenge and response bytes unchanged.

Development statusPhysical iPhone checks cover protected downloads, local resume, playlist modes and renewal. A test transport also verified local playback while SDK HTTP requests were blocked; device Wi-Fi remained on. Qualify fully disconnected playback, physical iPad devices and your own content/output policies before release. Packaged native sample distribution remains outstanding. The updated WayMaker HLS master and refreshed iPhone download have verified English and Chinese WebVTT captions. Other media requires its own compatible subtitle tracks. These player refinements are development builds, not a newly published customer SDK.

Register FairPlay before integration#

Configure the FairPlay deployment and certificate material in DRM-X Console. Private key material remains encrypted and server-side. Publish an HLS/CBCS variant for the Content ID you plan to test.

Request the Apple session#

Send drmSystem: fairplay, manifestTypes: ["hls"], and the appropriate clientPlatform from your authenticated backend. The response provides the registered HLS manifest, certificate route, CKC license route, authorization instructions, and release route.

Preserve native bytesDo not base64-transform, JSON-wrap, or reinterpret SPC and CKC data unless the returned contract explicitly requires it. Proxy the exact binary request and response types.

AVFoundation sequence#

Load the certificate.Fetch it from the returned FairPlay certificate URL with the returned bounded authorization.
Build content-key data.Use the skd:// identifier supplied by the HLS playlist and the application certificate.
Send the SPC.POST exact SPC bytes to the returned license URL and accept exact CKC bytes.
Finish and release.Respond to the content-key request, then release the DRM-X session when viewing ends.

Safari and app acceptance#

Test iPhone and iPad Safari with native HLS FairPlay.
Test macOS Safari with qualified Shaka MSE FairPlay where available and native HLS fallback.
Test native iOS, iPadOS, and tvOS playback, AirPlay policy, AV adapter policy, background transitions, renewal, and output changes.
Use different Development and Production FairPlay deployments and credentials.

Apple SDK

iOS, iPadOS, and tvOS with native FairPlay#

The Swift Package targets iOS and tvOS 15+. It uses AVFoundation’s AVContentKeySession for FairPlay content-key requests, with certificate retrieval, binary SPC/CKC exchange, renewal, cancellation, and session release.

import AVKit
import DrmXFairPlay

let controller = DrmXFairPlayPlayer()
let player = try await controller.prepare(
    endpoint: URL(string: "https://customer.example/api/drmx/playback-session")!,
    contentId: "course-12-lesson-4",
    contentType: .vod,
    customerHeaders: ["Authorization": "Bearer \(customerAccessToken)"]
)
playerViewController.player = player
player.play()

Your backend selects the policy template. Do not put a policy, manifest URL, Site Key, Access Key, or long-lived token in the app bundle. Test real HLS/CBCS media on physical iPhone, iPad, and Apple TV devices, including HDMI and AirPlay decisions.

One package, three integration choices#

Use Universal Player for iOS/iPadOS, Universal Player for tvOS, or the native AVPlayer integration above. All use the same DrmXFairPlay package and customer playback-session endpoint. The host application supplies customer authentication; tenant credentials remain on your backend.

The streaming player provides playlists, shuffle/repeat, cancellable auto-next, resume positions, seeking, speed, quality preferences, audio/subtitle selection, caption sizing, bookmarks, optional chapters/transcripts, A–B loops, sleep timers, and fullscreen. Its layout adapts to touch screens and the Apple TV remote.

let playlist = try DrmXPlaylist(items: [
    DrmXPlaylistItem(contentId: "lesson-1", title: "Getting started"),
    DrmXPlaylistItem(contentId: "lesson-2", title: "Next lesson")
])
let model = DrmXUniversalPlayer(
    endpoint: URL(string: "https://customer.example/api/drmx/playback-session")!,
    playlist: playlist,
    storageNamespace: "your-tenant-and-viewer"
) {
    ["Authorization": "Bearer \(customerAccessToken)"]
}
// Retain the model with @StateObject or an owning coordinator.
DrmXUniversalPlayerView(model: model)
// Stop when the owning screen is actually dismissed.
model.stop()

Quality settings are maximum preferences within the returned session ceiling. AVPlayer adapts to available bandwidth; FairPlay licenses and output restrictions remain authoritative. Positions and bookmarks persist by customer/viewer namespace without storing playback credentials.

The current development source places Previous/Play-Pause/Next, CC, Settings and fullscreen inside the video. Controls hide after two seconds during playback and reappear on touch or remote interaction. Shuffle, repeat and VOD progress persist within the supplied customer/viewer namespace, including downloaded playback. With shuffle and repeat off, the queue stops after its final video.

Protected downloads on iPhone and iPad

Pass an authenticated offlineEndpoint to DrmXUniversalPlayer to enable Download and downloaded-video mode. The iOS implementation uses AVAssetDownloadURLSession for local HLS packages and AVContentKeySession for device-bound persistent FairPlay keys. It stores opaque native keys and local metadata, never DRM License Tokens or clear keys. Downloads are isolated by customer/viewer namespace. The offline queue contains completed catalog items and shares saved positions, shuffle and repeat. License renewal requires fresh online authorization; removal erases only the selected download.

The PHP sample supports fairplay/hls/ios persistent requests. Configure each content item's trusted hlsManifestUrl; the certificate route uses the active deployment in the newly issued token. FairPlay enforces expiry. Offline quality remains the downloaded quality, and only cached language tracks are selectable. tvOS uses the streaming player.

Screen capture qualification

Use iPad and Apple TV simulators for layout, playlist controls, settings, and remote navigation. FairPlay playback is unavailable in these simulators; the SDK reports this limitation and releases its reservation instead of creating an unsupported native key session. Simulator UI results do not establish protected playback, offline download support, or physical-device acceptance.

The player pauses audio/video when iOS reports active recording or mirroring and covers inactive scenes. A screenshot notification arrives after capture and cannot redact an already saved image. The earlier sample allowed movie pixels in a saved screenshot. After installing the expanded player with native AVPlayerViewController presentation, the user repeated the WayMaker screenshot/Photos check on the development iPhone and confirmed the video area was black. Test other playback states, devices, recordings, AirPlay, and output-policy changes separately before release.