DRM-X 6.0 dove and olive branch logoDRM-X 6.0Docs
/

Native DRM integration

Integrate native Widevine, PlayReady, FairPlay, or WisePlay clients with DRM-X 6.0 using the Universal Playback Session Contract without embedding server credentials.

View MarkdownLive examples ↗Updated 2026-09-05
Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.
Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.

Responsibilities by layer#

LayerResponsibility
Customer backendAuthenticate, check entitlement, choose trusted Content ID and server-owned policy, request session.
DRM-XResolve package, validate policy, sign authorization, route provider requests, enforce lifecycle.
Native clientLoad registered manifest, initialize platform CDM, send native challenge, apply license, release session.

Common integration sequence#

  1. Detect supported DRM and truthful playback capabilities.
  2. Call your authenticated playback endpoint with a catalog reference.
  3. Load the returned manifest and initialize the requested key system.
  4. Attach the returned authorization only to the exact DRM certificate and license routes.
  5. Pass native binary challenge and license bodies without transformation.
  6. Apply licensed track and maximum-height restrictions.
  7. Call the release route on every terminal path.

Provider-specific care#

  • Widevine: keep PSSH/init data and license bodies binary; respect security-level qualification.
  • PlayReady: preserve the native challenge content type and response; qualify Edge and Windows on physical hardware.
  • FairPlay: use the application certificate with the SKD identifier and exact SPC/CKC exchange.
  • WisePlay: use the qualified initialization and session model supported by the target Huawei platform.

Fail closed#

Reject unregistered manifests, unexpected redirect destinations, changed content types, oversized bodies, expired authorization, mismatched DRM systems, and responses outside the session’s allowed origins. Never fall back from protected to clear content.