# Troubleshoot protected playback

Troubleshoot DRM-X 6.0 packaging, authorization, certificate, DRM license, manifest, decryption, and playback failures with safe redacted diagnostics.

Canonical: https://docs.drm-x.com/troubleshooting/playback
Updated: 2026-09-05

![Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.](https://docs.drm-x.com/assets/media-license-flow.svg)Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.

## Failure-stage matrix[#](#failure-stage-matrix)

| Stage | Typical evidence | First check | 
| --- | --- | --- |

| Entitlement | Your endpoint returns 401/403 | Login, subscription, course, rental, or event access. | 

| Session | Playback Session API rejects request | Credential scope, Site ID, Content ID, policy, and published status. | 

| Manifest | 404, CORS, parse, or segment error | Registered manifest, delivery hostname, object existence, and response headers. | 

| Key system | CDM unsupported or denied | Physical device, browser version, DRM capability, privacy mode, and OS support. | 

| Certificate | FairPlay certificate/SPC setup fails | Deployment, content type, authorization, and exact binary transport. | 

| License | Provider denial or binary parse failure | Token expiry, DRM match, challenge body, content type, and policy. | 

| Decrypt/play | Key status, codec, HDCP, decoder, or media error | KID mapping, allowed tier, output path, codec, and device limits. | 



## Use safe diagnostics[#](#use-safe-diagnostics)

- Generate a fresh debug session and reproduce one problem.
- Capture the Live redacted log and Playback diagnostics from the player.
- Keep only stage, event, correlation ID, status, duration, browser/OS, DRM, and redacted Content ID.
- Never include Access Keys, DRM License Tokens, authorization headers, manifest query secrets, native challenges, license responses, certificates, private keys, or content keys.



## Platform checks[#](#platform-checks)

### Windows Edge

Auto should prefer PlayReady on physical Windows Edge and only use bounded Widevine fallback if the qualified PlayReady startup path fails.

### macOS Safari

Use qualified Shaka MSE FairPlay when available, with native HLS fallback. Confirm MSE, FairPlay certificate, CKC, codec, and output policy separately.

### iPhone and iPad Safari

Use native HLS FairPlay. Test the real device, gesture/autoplay rules, foreground/background transitions, and exact SPC/CKC bytes.

### Android and TV

Check Widevine level, codec, decoder resolution, HDMI/HDCP, Media3 track selection, and lifecycle release.



## Before escalating[#](#before-escalating)

Provide the UTC time, debug session ID, correlation ID, Content ID, browser/OS/device, selected DRM, first failed stage, expected result, and redacted log. State whether the same Published protected file succeeds on another platform.