Node.js + Express video DRM integration

The three places you customize#

1. Configureexamples/sdk/node-express/server.mjs

   Set publicOrigin, instanceId and environment credentials.

2. Identify

   Your session/login middleware

   Populate req.user and supply identity: req => req.user?.id.

3. Authorizeauthorize(userId, videoId)

   Look up this video and check current permission; return the mapping or null.

1. Install and play one video#

cd examples/sdk/node-express
npm install
# Set DRMX_SITE_ID, DRMX_SITE_KEY and DRMX_ACCESS_KEY on the server.
# For localhost only, set DRMX_LOCAL_DEMO=1.
node server.mjs

Use Node.js 24+ and Express 5. Replace your-published-content-id inside authorize in server.mjs. Open http://127.0.0.1:8109/drmx/videos/1. The example installs the bundled @drmx/server and @drmx/express archives.

2. Connect real permissions#

Mount the router after your login middleware. Replace the demo callback; customerCatalog below represents your own database/service:

identity: req => req.user?.id,
authorize: async (userId, videoId) => {
  const video = await customerCatalog.findAuthorizedVideo(userId, videoId);
  if (!video) return null;
  return { enabled: true, contentId: video.drmxContentId,
           contentType: 'vod', title: video.title,
           policy: 'multi-tier-standard' };
}

Check purchase or membership, content availability, expiry and revocation in that query. The callback runs for both the page and each new session. Set the exact public HTTPS origin and disable the local demo middleware.

3. Open or embed the player#

The router provides GET /drmx/videos/:id and POST /drmx/videos/:id/session. Use the page first. To build your own page, reuse its script tags and Web Component, passing the authorized Content ID and the same video ID in the session URL.

Check before going live#

• Sign in as an allowed user and play a published video in a supported browser.
• Try signed-out and unpaid users, then revoke or expire access. New session requests must be denied.
• Change the browser Content ID or website video ID. The server must check the new selection.
• Set the exact public HTTPS origin, keep your framework’s session/CSRF protection, and disable demo identity code.

Existing sessions and DRM licenses have their own lifetimes. Permission changes are checked on new requests; they do not erase a license already issued.