DRM-X 6.0Native DRM integration
Integrate native Widevine, PlayReady, FairPlay, or WisePlay clients with DRM-X 6.0 using the Universal Playback Session Contract without embedding server credentials.
Encrypted video and DRM licenses follow separate paths
The CDN delivers encrypted video. Your backend checks access, and the DRM license service authorizes decryption on a compatible device.
- Storage / CDN
Delivers encrypted media to the player.
- Your backend
Checks whether the viewer is allowed to watch and requests playback authorization from DRM-X.
- DRM-X
Validates the playback authorization and handles the DRM license request.
- Player + device
Uses the device's DRM system to obtain a license and play the encrypted media.
Responsibilities by layer#
| Layer | Responsibility |
|---|---|
| Customer backend | Authenticate, check entitlement, choose trusted Content ID and server-owned policy, request session. |
| DRM-X | Resolve package, validate policy, sign authorization, route provider requests, enforce lifecycle. |
| Native client | Load registered manifest, initialize platform CDM, send native challenge, apply license, release session. |
Common integration sequence#
- Detect supported DRM and truthful playback capabilities.
- Call your authenticated playback endpoint with a catalog reference.
- Load the returned manifest and initialize the requested key system.
- Attach the returned authorization only to the exact DRM certificate and license routes.
- Pass native binary challenge and license bodies without transformation.
- Apply licensed track and maximum-height restrictions.
- Call the release route on every terminal path.
Provider-specific care#
- Widevine: keep PSSH/init data and license bodies binary; respect security-level qualification.
- PlayReady: preserve the native challenge content type and response; qualify Edge and Windows on physical hardware.
- FairPlay: use the application certificate with the SKD identifier and exact SPC/CKC exchange.
- WisePlay: use the qualified initialization and session model supported by the target Huawei platform.
Fail closed#
Reject unregistered manifests, unexpected redirect destinations, changed content types, oversized bodies, expired authorization, mismatched DRM systems, and responses outside the session’s allowed origins. Never fall back from protected to clear content.