License authorization overview

Integrate the DRM-X 6.0 Playback Session API, named policy templates, custom license policy, direct-token or token-proxy delivery, and session release.

View Markdown Live examples ↗Updated 2026-09-05

Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.

Create a playback session#

POST https://api6.drm-x.com/api/v1/playback/environments/{siteId}/sessions
Accept: application/json
Content-Type: application/json
X-DRMX-Client-Id: {siteKey}
X-DRMX-Client-Secret: {accessKey}

{
  "contentId": "course-12-lesson-4",
  "contentType": "vod",
  "drmSystem": "widevine",
  "subject": "customer-user-1001",
  "sessionId": "new-unpredictable-id-per-playback",
  "playbackMode": "streaming",
  "licensePolicyTemplate": "multi-tier-standard",
  "useEnvironmentDefaults": true,
  "applicationId": "customer-web"
}

All values come from trusted server state except detected client capability. Validate capability input against an allowlist and never accept entitlement, policy, or URLs from the client.

Choose a named policy template#

Template	Use it for
`single-software`	Single-key content with broad software-decryption compatibility.
`single-hdcp`	Single-key content that also requires approved digital output protection.
`single-hardware`	Single-key premium playback on qualified hardware-secure devices.
`multi-tier-standard`	Multi-key content with separate AUDIO, SD, HD, and UHD rules.

For custom policy, send one complete approved DRM-X License Policy JSON v2 from your server. Choose licensePolicyTemplate or licensePolicy, never both.

Direct token or customer proxy#

Direct-token

The fastest integration. The client receives a short-lived DRM License Token and attaches it only to the returned license or FairPlay certificate endpoint.

Token-proxy

Your server stores the real token in a bounded expiring cache and returns an opaque handle with customer-controlled proxy URLs. Bind the handle to the user, Content ID, DRM, and expiry.

Complete the lifecycle#

Return the session response with Cache-Control: no-store.
Use exact binary pass-through for native DRM challenge and response bodies.
Reject redirects and cap certificate, license, and log request sizes.
Call the returned release route on Stop, replacement, terminal error, and shutdown.
Never log authorization headers, successful session bodies, license bytes, challenges, or content keys.