Laravel and Node.js integrations

Add DRM-X to an authenticated application without exposing server credentials or trusting browser-supplied access decisions.

View Markdown Live examplesUpdated 2026-09-15

How playback is authorized

Your backend decides who can watch. DRM-X provides playback authorization. The player uses that authorization to request a DRM license.

Viewer
Signs in to your service and requests a video.
Your backend
Checks the user's purchase, subscription, or other permission to watch.
DRM-X
Applies the selected playback rules and returns the playback configuration and authorization.
Player
Uses the returned authorization to request the DRM license needed for playback.

Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.

Install the Laravel package#

Add the laravel directory as a Composer path repository and require haihaisoft/drmx-laravel. Publish drmx-config and run the package migration. Configure DRMX_SITE_ID, DRMX_SITE_KEY, DRMX_ACCESS_KEY and DRMX_INSTANCE_ID through your host environment.

composer require haihaisoft/drmx-laravel:@dev
php artisan vendor:publish --tag=drmx-config
php artisan migrate

Create drmx_videos and drmx_access records from trusted administrator or enrollment code. The access row uses the existing Laravel user ID and includes start, expiry and revocation fields. New video records are disabled by default.

Open /drmx/videos/VIDEO_ID after signing in. The web and auth middleware remain active, including Laravel CSRF validation. The Blade page passes the current CSRF token as _token in the session endpoint URL. Four tests pass on Laravel 12.69.2; other supported dependency versions need their own acceptance run.

Download third-party integration source

Integrate with an existing Node.js backend#

Use payloadFor and createSession from node/core.mjs inside a route protected by your existing authentication and CSRF middleware. Look up the video by an internal application ID, verify the current user’s access, then pass the trusted mapping and identity to payloadFor.

Never construct the identity, policy or enabled flag from the request body. The browser may request a Content ID and DRM system, but the server must compare them with the authorized video. Map exceptions to generic client errors and return Cache-Control: no-store.

The standalone Node bridge serves LTI and hosted-platform integrations. An ordinary Express, Fastify or Next.js application should reuse the core functions behind its own login and access checks. The bridge is not an open public session proxy.

React, Next.js and Vue#

Copy DrmxPlayer.tsx for React/Next.js, or DrmxPlayer.vue for Vue, together with runtime.mjs and runtime.d.mts. Both components load the pinned player scripts automatically, show loading and error messages, and remove the previous player when the content or session endpoint changes. Unmounting the component disconnects the player. You can translate label, loadingText and errorText through your application language pack.

Pass only Content ID, content type and the authenticated same-origin session URL. These wrappers do not grant access by themselves. A hidden button, an iframe URL or a front-end route guard is not a replacement for the backend permission check.