# Your first protected video

Start DRM-X 6.0 protected Web playback: publish content, create least-privilege credentials, authorize a viewer, and load the registered manifest.

Canonical: https://docs.drm-x.com/get-started/first-playback
Updated: 2026-09-05

![From Console to protected playback. Publish a title, create a server integration, change the marked settings, and verify playback.](https://docs.drm-x.com/assets/quickstart-flow.svg)From Console to protected playback. Publish a title, create a server integration, change the marked settings, and verify playback.

## 1. Publish one protected file[#](#1-publish-one-protected-file)

- **Choose an environment.**Use Development while integrating, then create separate Production credentials.
- **Open Package content.**Choose Single Key for broad compatibility or Multi-key Quality Tiered for separate AUDIO, SD, HD, and UHD controls.
- **Wait for Published.**Copy its Content ID. At playback, DRM-X resolves the registered DASH or HLS manifest; customers do not supply arbitrary manifest URLs.



## 2. Create a least-privilege server integration[#](#2-create-a-least-privilege-server-integration)

In Console → Integrations, create a Playback API client with only `license-tokens:create`. Copy Site ID, Site Key, and the one-time Access Key. Keep all three on your server; never put the Access Key in JavaScript, an APK, an IPA, or a TV app.

**Production recommendation**The samples allow direct code values for a fast first run. Before production, move the Access Key into your secret manager or protected environment configuration and rotate any value that was exposed.



## 3. Change the three marked server settings[#](#3-change-the-three-marked-server-settings)

```
// Server-side only
siteId: "your-development-environment-uuid"
siteKey: "drmx_your_environment_scoped_client_id"
accessKey: "paste-the-one-time-access-key"

contentId: "your-published-content-id"
licensePolicyTemplate: "multi-tier-standard"
```

Then replace the sample login and entitlement function with your real session, subscription, purchase, course enrollment, rental, or event-access check.



## 4. Request playback, then release it[#](#4-request-playback-then-release-it)

Create a new unpredictable session ID for each playback attempt. Return the successful session to the client with `Cache-Control: no-store`. Release the reservation on Stop, replacement, terminal error, and application shutdown.

- Never accept `subject`, policy JSON, manifest URL, or license URL directly from the player.
- Allow authorization headers only on the returned DRM license and FairPlay certificate routes.
- Record correlation IDs and stage outcomes, never tokens, keys, challenges, or license bytes.