Use a server-side token proxy

Keep the DRM License Token behind your own proxy#

Direct-token mode is simplest. Token-proxy mode keeps the real token server-side and returns an opaque, random, expiring handle plus customer-controlled license, FairPlay certificate, and release URLs.

{
  "drm": {
    "integrationMode": "token-proxy",
    "licenseServerUrl": "/api/drmx/license-proxy?kind=license&drm=widevine",
    "authorization": {
      "headerName": "Authorization",
      "scheme": "Bearer",
      "value": "opaque-random-customer-handle"
    }
  },
  "release": {
    "url": "/api/drmx/playback-release",
    "method": "POST",
    "authorization": {
      "headerName": "Authorization",
      "scheme": "Bearer",
      "value": "opaque-random-customer-handle"
    }
  }
}

Bind the handle to the authenticated customer session, Content ID, DRM system, and upstream token expiry. Store it only in a bounded expiring cache, cap request bodies, reject redirects, proxy exact binary challenge/response bytes, and erase it on release or expiry.

The live PHP sample implements both direct-token and token-proxy modes.