Web and HTML5 playback

Use the complete sample first#

The Web package contains the latest local Universal Player JavaScript and declarations, qualified Shaka, a runnable PHP application, a runnable ASP.NET Core example, and an integration README. Production pages may load Shaka and Universal Player from the DRM-X CDN; the package retains current local files for review, development, and controlled fallback.

1. Set server-side Site ID, Site Key, and Access Key.
2. Set the trusted Published protected file Content ID and named policy.
3. Replace the sample login and entitlement decision with your business logic.

Minimal client boundary#

<script src="https://drm-x6-cdn.1aicloud.com/sdk/drmx-universal-player/v1/drmx-universal-player.js"></script>
<drmx-universal-player id="player"></drmx-universal-player>
<script>
  // Call your authenticated backend, not api6.drm-x.com.
  const session = await fetch('/api/playback/session', {
    method: 'POST',
    headers: {'Content-Type': 'application/json'},
    body: JSON.stringify({contentId: 'trusted-catalog-reference'})
  }).then(r => r.json());
  await window.DrmXUniversalPlayer.start(document.querySelector('#player'), session);
</script>

Automatic DRM behavior#

• Windows Microsoft Edge prefers PlayReady. If the qualified PlayReady path fails before playback, Auto mode may use bounded Widevine fallback.
• Chrome and supported Android browsers use Widevine.
• Safari on iPhone and iPad uses native HLS FairPlay. On supported macOS Safari, qualified Shaka MSE FairPlay is preferred when available, with native HLS fallback.
• Compatible Huawei browsers use the qualified WisePlay path and conservative automatic quality behavior.

Production checklist#

• Serve everything over HTTPS and keep Access Keys in server secrets.
• Return playback-session responses with Cache-Control: no-store.
• Do not persist manifest URLs, tokens, or session responses in localStorage.
• Keep detailed redacted logs opt-in and time-bounded; do not record license bytes or authorization.
• Test physical Windows Edge, macOS Safari, iPhone/iPad Safari, Android, and every device class you advertise.