# Use a server-side token proxy

Keep the DRM License Token behind your own backend while preserving native DRM challenges and license response bytes.

Canonical: https://docs.drm-x.com/license-service/token-proxy
Updated: 2026-09-05

![Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.](https://docs.drm-x.com/assets/session-flow.svg)Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.

Advanced server boundary 

## Keep the DRM License Token behind your own proxy[#](#keep-the-drm-license-token-behind-your-own-proxy)



Direct-token mode is simplest. Token-proxy mode keeps the real token server-side and returns an opaque, random, expiring handle plus customer-controlled license, FairPlay certificate, and release URLs.



```
{
"drm": {
"integrationMode": "token-proxy",
"licenseServerUrl": "/api/drmx/license-proxy?kind=license&drm=widevine",
"authorization": {
"headerName": "Authorization",
"scheme": "Bearer",
"value": "opaque-random-customer-handle"
}
},
"release": {
"url": "/api/drmx/playback-release",
"method": "POST",
"authorization": {
"headerName": "Authorization",
"scheme": "Bearer",
"value": "opaque-random-customer-handle"
}
}
}
```



Bind the handle to the authenticated customer session, Content ID, DRM system, and upstream token expiry. Store it only in a bounded expiring cache, cap request bodies, reject redirects, proxy exact binary challenge/response bytes, and erase it on release or expiry.



The [live PHP sample](https://developer.drm-x.com/php-sample/) implements both direct-token and token-proxy modes.