# Backend language examples

DRM-X 6.0 backend integration patterns for PHP, ASP.NET Core, Node.js, Python, Java, Go, and Ruby using one secure Playback Session API.

Canonical: https://docs.drm-x.com/integrations/backend-languages
Updated: 2026-09-05

![Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.](https://docs.drm-x.com/assets/session-flow.svg)Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.

## The language-independent request[#](#the-language-independent-request)

```
POST /api/v1/playback/environments/{siteId}/sessions
X-DRMX-Client-Id: {siteKey}
X-DRMX-Client-Secret: {accessKey}

{
"contentId": "trusted-content-id",
"contentType": "vod",
"drmSystem": "widevine",
"subject": "authenticated-user-id",
"sessionId": "new-id-for-this-attempt",
"licensePolicyTemplate": "multi-tier-standard",
"useEnvironmentDefaults": true
}
```



## Choose your backend[#](#choose-your-backend)

### PHP 8.2+

Use cURL with JSON exceptions, HTTPS-only protocols, a 12-second timeout, and explicit response-status handling. The complete PHP app includes login, entitlement, direct-token, token-proxy, diagnostics, and release.

[Run PHP sample](https://developer.drm-x.com/php-sample/)

### ASP.NET Core

Use the supplied options validation, typed `HttpClient`, cancellation, `JsonContent`, and endpoint helper. Configuration values are clear in code for the first run with secret-manager alternatives commented.

### Node.js / TypeScript

Use `fetch` with `AbortSignal.timeout`, server-only configuration, response schema validation, and `Cache-Control: no-store`.

### Python 3.11+

Use an HTTPS client with explicit timeouts, JSON serialization, status checks, and secret injection from the production runtime.

### Java 21+

Use `HttpClient` with request timeout, exact credential headers, validated JSON, and no redirects to untrusted origins.

### Go or Ruby

Use a request context/timeout, exact JSON fields, strict status checks, and never print credential or successful playback response bodies.



## Map business values safely[#](#map-business-values-safely)

| Request field | Source | 
| --- | --- |

| `contentId` | Server mapping from your catalog to a Published protected file. | 

| `subject` | Your authenticated user ID; never a browser-provided identity. | 

| `licensePolicyTemplate` | Server mapping from trusted plan, rental, course, or content tier. | 

| `drmSystem` | Validated client capability, limited to DRM systems your integration supports. | 

| `sessionId` | Fresh unpredictable identifier created by your backend for this playback attempt. | 



## Use direct code values only for the first run[#](#use-direct-code-values-only-for-the-first-run)

The samples intentionally make the small set of settings easy to find. For production, uncomment the documented environment/secret-manager alternative, remove hard-coded secrets, rotate the client, and grant only `license-tokens:create`.



Server tutorials 

## Call the same endpoint from popular backend languages[#](#call-the-same-endpoint-from-popular-backend-languages)



In every example, authenticate the viewer and check entitlement before this call. PHP and ASP.NET show direct code values for the first run; move the Access Key to a secret manager for production and never log request headers or the successful response body.

PHP 8.2+



```
$drmx = [
'platformApi' => 'https://api6.drm-x.com',
'siteId' => 'your-development-environment-uuid',
'siteKey' => 'drmx_your_environment_scoped_client_id',
'accessKey' => 'paste-your-one-time-access-key',
];

$payload = [
'contentId' => $trustedContentId,
'contentType' => 'vod',
'drmSystem' => $drmSystem,
'subject' => $authenticatedUserId,
'playbackMode' => 'streaming',
'licensePolicyTemplate' => 'multi-tier-standard',
'useEnvironmentDefaults' => true,
'maximumQualityTier' => 'auto',
];

$curl = curl_init($drmx['platformApi'] . '/api/v1/playback/environments/' .
rawurlencode($drmx['siteId']) . '/sessions');
curl_setopt_array($curl, [
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => json_encode($payload, JSON_THROW_ON_ERROR),
CURLOPT_RETURNTRANSFER => true,
CURLOPT_TIMEOUT => 12,
CURLOPT_PROTOCOLS => CURLPROTO_HTTPS,
CURLOPT_HTTPHEADER => [
'Accept: application/json',
'Content-Type: application/json',
'X-DRMX-Client-Id: ' . $drmx['siteKey'],
'X-DRMX-Client-Secret: ' . $drmx['accessKey'],
],
]);
$body = curl_exec($curl);
```



Start from the complete executable sample; it includes login, entitlement, direct-token mode, token-proxy mode, bounded diagnostics, and release handling.

Node.js / TypeScript



```
const response = await fetch(
`${process.env.DRMX_PLATFORM_API}/api/v1/playback/environments/${
encodeURIComponent(process.env.DRMX_PLAYBACK_SITE_ID!)
}/sessions`,
{
method: "POST",
headers: {
"Accept": "application/json",
"Content-Type": "application/json",
"X-DRMX-Client-Id": process.env.DRMX_PLAYBACK_SITE_KEY!,
"X-DRMX-Client-Secret": process.env.DRMX_PLAYBACK_ACCESS_KEY!,
},
body: JSON.stringify({
contentId: trustedContentId,
contentType: "vod",
drmSystem,
subject: authenticatedUser.id,
playbackMode: "streaming",
licensePolicyTemplate: "multi-tier-standard",
useEnvironmentDefaults: true,
maximumQualityTier: "auto",
}),
signal: AbortSignal.timeout(12_000),
},
);
const playback = await response.json();
```

Python 3.11+



```
import json, os, urllib.request

payload = json.dumps({
"contentId": trusted_content_id,
"contentType": "vod",
"drmSystem": drm_system,
"subject": authenticated_user_id,
"playbackMode": "streaming",
"licensePolicyTemplate": "multi-tier-standard",
"useEnvironmentDefaults": True,
"maximumQualityTier": "auto",
}).encode("utf-8")

url = (
os.environ["DRMX_PLATFORM_API"] +
"/api/v1/playback/environments/" +
os.environ["DRMX_PLAYBACK_SITE_ID"] + "/sessions"
)
request = urllib.request.Request(url, data=payload, method="POST", headers={
"Accept": "application/json",
"Content-Type": "application/json",
"X-DRMX-Client-Id": os.environ["DRMX_PLAYBACK_SITE_KEY"],
"X-DRMX-Client-Secret": os.environ["DRMX_PLAYBACK_ACCESS_KEY"],
})
with urllib.request.urlopen(request, timeout=12) as response:
playback = json.load(response)
```

ASP.NET Core / C#



```
builder.Services.AddDrmXPlayback(options =>
{
options.PlatformApi = "https://api6.drm-x.com";
options.SiteId = "your-development-environment-uuid";
options.SiteKey = "drmx_your_environment_scoped_client_id";
options.AccessKey = "paste-your-one-time-access-key";
options.ApplicationId = "customer-aspnet-website";
options.LicensePolicyTemplate = "multi-tier-standard";
});

var payload = new {
contentId = trustedContentId,
contentType = "vod",
drmSystem,
subject = authenticatedUserId,
playbackMode = "streaming",
licensePolicyTemplate = "multi-tier-standard",
useEnvironmentDefaults = true,
maximumQualityTier = "auto"
};

using var request = new HttpRequestMessage(HttpMethod.Post,
$"{platformApi}/api/v1/playback/environments/{Uri.EscapeDataString(siteId)}/sessions") {
Content = JsonContent.Create(payload)
};
request.Headers.Add("X-DRMX-Client-Id", siteKey);
request.Headers.Add("X-DRMX-Client-Secret", accessKey);
using var response = await httpClient.SendAsync(request, cancellationToken);
```

Java 21 / Spring services



```
String payload = objectMapper.writeValueAsString(Map.of(
"contentId", trustedContentId,
"contentType", "vod",
"drmSystem", drmSystem,
"subject", authenticatedUserId,
"playbackMode", "streaming",
"licensePolicyTemplate", "multi-tier-standard",
"useEnvironmentDefaults", true,
"maximumQualityTier", "auto"
));

HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create(platformApi + "/api/v1/playback/environments/" +
URLEncoder.encode(siteId, StandardCharsets.UTF_8) + "/sessions"))
.timeout(Duration.ofSeconds(12))
.header("Accept", "application/json")
.header("Content-Type", "application/json")
.header("X-DRMX-Client-Id", siteKey)
.header("X-DRMX-Client-Secret", accessKey)
.POST(HttpRequest.BodyPublishers.ofString(payload))
.build();
HttpResponse<String> response = client.send(request,
HttpResponse.BodyHandlers.ofString());
```

Go 1.23+



```
payload, _ := json.Marshal(map[string]any{
"contentId": trustedContentID,
"contentType": "vod",
"drmSystem": drmSystem,
"subject": authenticatedUserID,
"playbackMode": "streaming",
"licensePolicyTemplate": "multi-tier-standard",
"useEnvironmentDefaults": true,
"maximumQualityTier": "auto",
})

url := platformAPI + "/api/v1/playback/environments/" +
url.PathEscape(siteID) + "/sessions"
req, _ := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(payload))
req.Header.Set("Accept", "application/json")
req.Header.Set("Content-Type", "application/json")
req.Header.Set("X-DRMX-Client-Id", siteKey)
req.Header.Set("X-DRMX-Client-Secret", accessKey)
response, err := httpClient.Do(req)
```

Ruby 3.3+



```
uri = URI("#{ENV.fetch('DRMX_PLATFORM_API')}/api/v1/playback/environments/" \
"#{ERB::Util.url_encode(ENV.fetch('DRMX_PLAYBACK_SITE_ID'))}/sessions")
request = Net::HTTP::Post.new(uri)
request['Accept'] = 'application/json'
request['Content-Type'] = 'application/json'
request['X-DRMX-Client-Id'] = ENV.fetch('DRMX_PLAYBACK_SITE_KEY')
request['X-DRMX-Client-Secret'] = ENV.fetch('DRMX_PLAYBACK_ACCESS_KEY')
request.body = JSON.generate(
contentId: trusted_content_id,
contentType: 'vod',
drmSystem: drm_system,
subject: authenticated_user_id,
playbackMode: 'streaming',
licensePolicyTemplate: 'multi-tier-standard',
useEnvironmentDefaults: true,
maximumQualityTier: 'auto'
)
response = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |http| http.request(request) }
```