# 后端语言示例

通过统一的 Playback Session API 接入 DRM-X 6.0 后端授权，查看 PHP、ASP.NET Core、Node.js、Python、Java、Go 和 Ruby 的接入示例。

播放授权的流程

您的后端决定谁可以观看。DRM-X 提供播放授权，播放器使用该授权请求 DRM 许可证。

- 01**观看用户**

登录您的服务并请求播放视频。

- 02**您的后端**

检查用户的购买记录、订阅状态或其他观看权限。

- 03**DRM-X**

应用所选播放规则，返回播放配置和授权信息。

- 04**播放器**

使用返回的授权信息，请求播放所需的 DRM 许可证。

您的后端决定访问; DRM-X 执行已签名的政策。 加密的媒体和DRM 许可证会遵循不同的传送路径 。

## 适用于各后端语言的统一请求[#](#the-language-independent-request)

```
POST /api/v1/playback/environments/{siteId}/sessions
X-DRMX-Client-Id: {siteKey}
X-DRMX-Client-Secret: {accessKey}

{
  "contentId": "trusted-content-id",
  "contentType": "vod",
  "drmSystem": "widevine",
  "subject": "authenticated-user-id",
  "sessionId": "new-id-for-this-attempt",
  "licensePolicyTemplate": "multi-tier-standard",
  "useEnvironmentDefaults": true
}
```



## 选择您的后端[#](#choose-your-backend)

### PHP 8.2+

使用 cURL，仅允许 HTTPS，设置 12 秒超时，对 JSON 错误抛出异常，并明确处理响应状态。完整 PHP 应用包含登录、观看权限检查、Direct-token、Token-proxy、诊断及会话释放。

[运行 PHP 示例](https://developer.drm-x.com/php-sample/)

### ASP.NET Core

使用示例提供的配置验证、类型化 `HttpClient`、取消机制、`JsonContent` 和接口辅助方法。为方便首次运行，配置值直接列在代码中，同时以注释提供密钥管理服务的替代配置。

### Node.js / TypeScript

使用 `fetch` 和 `AbortSignal.timeout`，将配置保留在服务器端，验证响应结构，并设置 `Cache-Control: no-store`。

### Python 3.11+

使用 HTTPS 客户端，明确设置超时，正确序列化 JSON 并检查响应状态；凭据由生产运行环境注入。

### Java 21+

使用 `HttpClient`，设置请求超时，准确传递凭据请求头并验证 JSON；不要跟随跳转到不可信源站的重定向。

### Go 或 Ruby

设置请求上下文和超时，使用准确的 JSON 字段并严格检查响应状态。不要输出凭据或成功播放响应体。



## 安全映射业务参数[#](#map-business-values-safely)

| 请求字段 | 源文件 | 
| --- | --- |

| `contentId` | 在服务器端将目录记录映射到状态为 Published 的加密文件。 | 

| `subject` | 从已认证的会话中取得用户 ID，不采用浏览器提交的身份。 | 

| `licensePolicyTemplate` | 根据可信的套餐、租赁、课程或内容档位，在服务器端进行映射。 | 

| `drmSystem` | 已验证的客户端能力，仅包含当前集成支持的 DRM 系统。 | 

| `sessionId` | 由后端为本次播放生成的新标识，应具有不可预测性。 | 



## 代码中直接填写配置仅用于首次运行[#](#use-direct-code-values-only-for-the-first-run)

示例将少量配置集中列出，便于首次运行时找到。生产部署时，请启用文档中已注释的环境变量或密钥管理服务配置方案，删除硬编码凭据，更换 API 客户端凭据，并仅授予 `license-tokens:create` 权限。



服务器教程 

## 使用常见后端语言调用同一个接口[#](#call-the-same-endpoint-from-popular-backend-languages)



所有示例都要求先认证用户并检查观看权限，再调用此接口。PHP 和 ASP.NET 示例为方便首次运行，在代码中直接列出配置值。生产部署时请将 Access Key 移至密钥管理服务，且不要记录请求头或成功响应体。

PHP 8.2+



```
$drmx = [
    'platformApi' => 'https://api6.drm-x.com',
    'siteId' => 'your-development-environment-uuid',
    'siteKey' => 'drmx_your_environment_scoped_client_id',
    'accessKey' => 'paste-your-one-time-access-key',
];

$payload = [
    'contentId' => $trustedContentId,
    'contentType' => 'vod',
    'drmSystem' => $drmSystem,
    'subject' => $authenticatedUserId,
    'playbackMode' => 'streaming',
    'licensePolicyTemplate' => 'multi-tier-standard',
    'useEnvironmentDefaults' => true,
    'maximumQualityTier' => 'auto',
];

$curl = curl_init($drmx['platformApi'] . '/api/v1/playback/environments/' .
    rawurlencode($drmx['siteId']) . '/sessions');
curl_setopt_array($curl, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode($payload, JSON_THROW_ON_ERROR),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 12,
    CURLOPT_PROTOCOLS => CURLPROTO_HTTPS,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Content-Type: application/json',
        'X-DRMX-Client-Id: ' . $drmx['siteKey'],
        'X-DRMX-Client-Secret: ' . $drmx['accessKey'],
    ],
]);
$body = curl_exec($curl);
```



从完整、可运行的示例开始。示例涵盖登录、观看权限检查、Direct-token 模式、Token-proxy 模式、有限范围的诊断及会话释放处理。

Node.js / TypeScript



```
const response = await fetch(
  `${process.env.DRMX_PLATFORM_API}/api/v1/playback/environments/${
    encodeURIComponent(process.env.DRMX_PLAYBACK_SITE_ID!)
  }/sessions`,
  {
    method: "POST",
    headers: {
      "Accept": "application/json",
      "Content-Type": "application/json",
      "X-DRMX-Client-Id": process.env.DRMX_PLAYBACK_SITE_KEY!,
      "X-DRMX-Client-Secret": process.env.DRMX_PLAYBACK_ACCESS_KEY!,
    },
    body: JSON.stringify({
      contentId: trustedContentId,
      contentType: "vod",
      drmSystem,
      subject: authenticatedUser.id,
      playbackMode: "streaming",
      licensePolicyTemplate: "multi-tier-standard",
      useEnvironmentDefaults: true,
      maximumQualityTier: "auto",
    }),
    signal: AbortSignal.timeout(12_000),
  },
);
const playback = await response.json();
```

Python 3.11+



```
import json, os, urllib.request

payload = json.dumps({
    "contentId": trusted_content_id,
    "contentType": "vod",
    "drmSystem": drm_system,
    "subject": authenticated_user_id,
    "playbackMode": "streaming",
    "licensePolicyTemplate": "multi-tier-standard",
    "useEnvironmentDefaults": True,
    "maximumQualityTier": "auto",
}).encode("utf-8")

url = (
    os.environ["DRMX_PLATFORM_API"] +
    "/api/v1/playback/environments/" +
    os.environ["DRMX_PLAYBACK_SITE_ID"] + "/sessions"
)
request = urllib.request.Request(url, data=payload, method="POST", headers={
    "Accept": "application/json",
    "Content-Type": "application/json",
    "X-DRMX-Client-Id": os.environ["DRMX_PLAYBACK_SITE_KEY"],
    "X-DRMX-Client-Secret": os.environ["DRMX_PLAYBACK_ACCESS_KEY"],
})
with urllib.request.urlopen(request, timeout=12) as response:
    playback = json.load(response)
```

ASP.NET Core / C#



```
builder.Services.AddDrmXPlayback(options =>
{
    options.PlatformApi = "https://api6.drm-x.com";
    options.SiteId = "your-development-environment-uuid";
    options.SiteKey = "drmx_your_environment_scoped_client_id";
    options.AccessKey = "paste-your-one-time-access-key";
    options.ApplicationId = "customer-aspnet-website";
    options.LicensePolicyTemplate = "multi-tier-standard";
});

var payload = new {
    contentId = trustedContentId,
    contentType = "vod",
    drmSystem,
    subject = authenticatedUserId,
    playbackMode = "streaming",
    licensePolicyTemplate = "multi-tier-standard",
    useEnvironmentDefaults = true,
    maximumQualityTier = "auto"
};

using var request = new HttpRequestMessage(HttpMethod.Post,
    $"{platformApi}/api/v1/playback/environments/{Uri.EscapeDataString(siteId)}/sessions") {
    Content = JsonContent.Create(payload)
};
request.Headers.Add("X-DRMX-Client-Id", siteKey);
request.Headers.Add("X-DRMX-Client-Secret", accessKey);
using var response = await httpClient.SendAsync(request, cancellationToken);
```

Java 21 / Spring 服务



```
String payload = objectMapper.writeValueAsString(Map.of(
    "contentId", trustedContentId,
    "contentType", "vod",
    "drmSystem", drmSystem,
    "subject", authenticatedUserId,
    "playbackMode", "streaming",
    "licensePolicyTemplate", "multi-tier-standard",
    "useEnvironmentDefaults", true,
    "maximumQualityTier", "auto"
));

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create(platformApi + "/api/v1/playback/environments/" +
        URLEncoder.encode(siteId, StandardCharsets.UTF_8) + "/sessions"))
    .timeout(Duration.ofSeconds(12))
    .header("Accept", "application/json")
    .header("Content-Type", "application/json")
    .header("X-DRMX-Client-Id", siteKey)
    .header("X-DRMX-Client-Secret", accessKey)
    .POST(HttpRequest.BodyPublishers.ofString(payload))
    .build();
HttpResponse<String> response = client.send(request,
    HttpResponse.BodyHandlers.ofString());
```

Go 1.23+



```
payload, _ := json.Marshal(map[string]any{
    "contentId": trustedContentID,
    "contentType": "vod",
    "drmSystem": drmSystem,
    "subject": authenticatedUserID,
    "playbackMode": "streaming",
    "licensePolicyTemplate": "multi-tier-standard",
    "useEnvironmentDefaults": true,
    "maximumQualityTier": "auto",
})

url := platformAPI + "/api/v1/playback/environments/" +
    url.PathEscape(siteID) + "/sessions"
req, _ := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(payload))
req.Header.Set("Accept", "application/json")
req.Header.Set("Content-Type", "application/json")
req.Header.Set("X-DRMX-Client-Id", siteKey)
req.Header.Set("X-DRMX-Client-Secret", accessKey)
response, err := httpClient.Do(req)
```

Ruby 3.3+



```
uri = URI("#{ENV.fetch('DRMX_PLATFORM_API')}/api/v1/playback/environments/" \
          "#{ERB::Util.url_encode(ENV.fetch('DRMX_PLAYBACK_SITE_ID'))}/sessions")
request = Net::HTTP::Post.new(uri)
request['Accept'] = 'application/json'
request['Content-Type'] = 'application/json'
request['X-DRMX-Client-Id'] = ENV.fetch('DRMX_PLAYBACK_SITE_KEY')
request['X-DRMX-Client-Secret'] = ENV.fetch('DRMX_PLAYBACK_ACCESS_KEY')
request.body = JSON.generate(
  contentId: trusted_content_id,
  contentType: 'vod',
  drmSystem: drm_system,
  subject: authenticated_user_id,
  playbackMode: 'streaming',
  licensePolicyTemplate: 'multi-tier-standard',
  useEnvironmentDefaults: true,
  maximumQualityTier: 'auto'
)
response = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |http| http.request(request) }
```

<!-- Canonical: https://docs.drm-x.com/zh-Hans/integrations/backend-languages -->
<!-- Language: zh-Hans -->