# License authorization overview

Integrate the DRM-X 6.0 Playback Session API, named policy templates, custom license policy, direct-token or token-proxy delivery, and session release.

Canonical: https://docs.drm-x.com/license-service/overview
Updated: 2026-09-05

![Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.](https://docs.drm-x.com/assets/session-flow.svg)Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.

## Create a playback session[#](#create-a-playback-session)

```
POST https://api6.drm-x.com/api/v1/playback/environments/{siteId}/sessions
Accept: application/json
Content-Type: application/json
X-DRMX-Client-Id: {siteKey}
X-DRMX-Client-Secret: {accessKey}
```

```
{
"contentId": "course-12-lesson-4",
"contentType": "vod",
"drmSystem": "widevine",
"subject": "customer-user-1001",
"sessionId": "new-unpredictable-id-per-playback",
"playbackMode": "streaming",
"licensePolicyTemplate": "multi-tier-standard",
"useEnvironmentDefaults": true,
"applicationId": "customer-web"
}
```

All values come from trusted server state except detected client capability. Validate capability input against an allowlist and never accept entitlement, policy, or URLs from the client.



## Choose a named policy template[#](#choose-a-named-policy-template)

| Template | Use it for | 
| --- | --- |

| `single-software` | Single-key content with broad software-decryption compatibility. | 

| `single-hdcp` | Single-key content that also requires approved digital output protection. | 

| `single-hardware` | Single-key premium playback on qualified hardware-secure devices. | 

| `multi-tier-standard` | Multi-key content with separate AUDIO, SD, HD, and UHD rules. | 

For custom policy, send one complete approved DRM-X License Policy JSON v2 from your server. Choose `licensePolicyTemplate` or `licensePolicy`, never both.



## Direct token or customer proxy[#](#direct-token-or-customer-proxy)

### Direct-token

The fastest integration. The client receives a short-lived DRM License Token and attaches it only to the returned license or FairPlay certificate endpoint.

### Token-proxy

Your server stores the real token in a bounded expiring cache and returns an opaque handle with customer-controlled proxy URLs. Bind the handle to the user, Content ID, DRM, and expiry.



## Complete the lifecycle[#](#complete-the-lifecycle)

- Return the session response with `Cache-Control: no-store`.
- Use exact binary pass-through for native DRM challenge and response bodies.
- Reject redirects and cap certificate, license, and log request sizes.
- Call the returned release route on Stop, replacement, terminal error, and shutdown.
- Never log authorization headers, successful session bodies, license bytes, challenges, or content keys.