DRM-X 6.0 dove and olive branch logoDRM-X 6.0Docs
/

Your first protected video

Start DRM-X 6.0 protected Web playback: publish content, create least-privilege credentials, authorize a viewer, and load the registered manifest.

View MarkdownLive examples ↗Updated 2026-09-05
From Console to protected playback. Publish a title, create a server integration, change the marked settings, and verify playback.
From Console to protected playback. Publish a title, create a server integration, change the marked settings, and verify playback.

1. Publish one protected file#

  1. Choose an environment.Use Development while integrating, then create separate Production credentials.
  2. Open Package content.Choose Single Key for broad compatibility or Multi-key Quality Tiered for separate AUDIO, SD, HD, and UHD controls.
  3. Wait for Published.Copy its Content ID. At playback, DRM-X resolves the registered DASH or HLS manifest; customers do not supply arbitrary manifest URLs.

2. Create a least-privilege server integration#

In Console → Integrations, create a Playback API client with only license-tokens:create. Copy Site ID, Site Key, and the one-time Access Key. Keep all three on your server; never put the Access Key in JavaScript, an APK, an IPA, or a TV app.

Production recommendationThe samples allow direct code values for a fast first run. Before production, move the Access Key into your secret manager or protected environment configuration and rotate any value that was exposed.

3. Change the three marked server settings#

// Server-side only
siteId: "your-development-environment-uuid"
siteKey: "drmx_your_environment_scoped_client_id"
accessKey: "paste-the-one-time-access-key"

contentId: "your-published-content-id"
licensePolicyTemplate: "multi-tier-standard"

Then replace the sample login and entitlement function with your real session, subscription, purchase, course enrollment, rental, or event-access check.

4. Request playback, then release it#

Create a new unpredictable session ID for each playback attempt. Return the successful session to the client with Cache-Control: no-store. Release the reservation on Stop, replacement, terminal error, and application shutdown.

  • Never accept subject, policy JSON, manifest URL, or license URL directly from the player.
  • Allow authorization headers only on the returned DRM license and FairPlay certificate routes.
  • Record correlation IDs and stage outcomes, never tokens, keys, challenges, or license bytes.