Video security

Set up DRM encryption

Implement DRM protection with Widevine, PlayReady, and FairPlay for secure video streaming.

Digital Rights Management (DRM) is an essential security feature for video content streamed via FastPix. By integrating DRM, you can prevent unauthorized content usage through methods like:

  • Screen recording
  • Screen sharing
  • Downloading tools

With DRM, video segments are encrypted using MPEG Common Encryption in CBCS mode, employing AES symmetric encryption. Additionally, a license request is required to deliver a decryption key, enabling video playback.

FastPix supports the industry-standard DRM protocols for secure video delivery:

  • Google Widevine: Android devices and Chrome browsers
  • Microsoft PlayReady: Windows platforms, including Xbox
  • Apple FairPlay: Apple devices (Safari browsers on macOS, iOS, and iPadOS)

PLEASE NOTE

If you haven’t yet obtained a FairPlay certificate, we can provide guidance on how to obtain one. Please reach out to FastPix support for more details.


Configure DRM for your videos

Step 1: Create a Workspace for DRM Testing

For the best results during our beta phase, we recommend creating a new, isolated workspace for testing DRM-protected content.

  1. Navigate to the Workspace tab in your dashboard to create a workspace.
  2. Copy your workspace key (e.g., 1049319898967698465).
  3. Send this key to FastPix support, and we’ll onboard you when slots are available.


Step 2: Receive your DRM configuration ID

After onboarding, we’ll send you a DRM configuration ID for your workspace. This ID can also be found in the Settings tab of your dashboard. You’ll need this ID when creating media with a DRM playback policy.

Example of a DRM configuration ID: 1fd649fe-b84e-494d-b4b3-118ad6c5e4d7


PLEASE NOTE

This is an example, and you will receive a unique ID.


FairPlay DRM on Apple devices

To ensure DRM-protected content plays on Apple devices (Safari on macOS, or any browser on iOS/iPadOS), you must obtain a FairPlay certificate from Apple. Without this certificate, DRM-protected content will not be playable.

Once you’ve obtained the FairPlay certificate (.cer file), upload it to the DRM section under the Settings tab of your FastPix dashboard.

If you need help obtaining a FairPlay certificate, Please contact FastPix support for assistance.



Creating media with a DRM playback policy

Currently, DRM can only be applied to Video on Demand (VOD) content.

To create DRM-protected media, follow these steps:

  1. Obtain your DRM configuration ID: Make sure you have the DRM configuration ID from the previous step.
  2. Create media with DRM protection: Use the DRM configuration ID and set the accessPolicy to drm in your media creation request. Below is an example of the required JSON format for creating a DRM-protected media:
1{
2  "inputs": [
3    {
4      "type": "video",
5      "url": "https://static.fastpix.com/sample.mp4"
6    }
7  ],
8  "metadata": {
9    "key1": "value1"
10  },
11  "accessPolicy": "drm",
12  "maxResolution": "1080p",
13  "drmConfigurationId": "1fd539fe-b84e-494d-b4b3-118ad6c5e4a4"
14}


Integrating DRM with a third-party player

If you’re not using the FastPix player, you can still integrate DRM-protected playback into third-party players that support industry-standard DRM systems like Widevine and FairPlay.

FastPix streams are fully compatible with any player that can handle HLS with CBCS encryption, and most players that implement Encrypted Media Extensions (EME) and Media Source Extensions (MSE) will work out of the box.


DRM License URL Formats

When integrating, you’ll need to use FastPix’s license and certificate endpoints, inserting the playbackId of your asset and a drmToken generated for the current session or user.

Widevine

https://api.fastpix.com/v1/on-demand/drm/license/widevine/{playbackId}?token={drmToken}

FairPlay

Before using FairPlay, confirm that FairPlay support is enabled on your FastPix account.

  • License URL: 
    https://api.fastpix.com/v1/on-demand/drm/license/fairplay/{playbackId}?token={drmToken}
  • Certificate URL: 
    https://api.fastpix.com/v1/on-demand/drm/cert/fairplay/{playbackId}?token={drmToken}


Integration examples

Below are working configurations for popular third-party players.


HLS.js (For Web)

1if (Hls.isSupported()) { 
2const hls = new Hls({ 
3emeEnabled: true, 
4drmSystems: { 
5'com.widevine.alpha': { 
6licenseUrl: 'https://api.fastpix.com/v1/on-demand/drm/license/widevine/{playbackId}?token={drmToken}' 
7}, 
8'com.microsoft.playready': { 
9licenseUrl: 'https://api.fastpix.com/v1/on-demand/drm/license/playready/{playbackId}?token={drmToken}' 
10}, 
11'com.apple.fps': { 
12licenseUrl: 'https://api.fastpix.com/v1/on-demand/drm/license/fairplay/{playbackId}?token={drmToken}', 
13serverCertificateUrl: 'https://api.fastpix.com/v1/on-demand/drm/cert/fairplay/{playbackId}?token={drmToken}', 
14} 
15} 
16}); 
17hls.attachMedia(videoElement); 
18hls.loadSource(`https://cdn.fastpix.io/${playbackId}.m3u8?token=${playbackToken}`); 
19}

Video.js (with videojs-contrib-eme) - For Web

1const PLAYBACK_ID = 'PLAYBACK_ID'; // Replace with actual playback ID
2const DRM_LICENSE_TOKEN = 'DRM_TOKEN'; // Replace with actual DRM license token
3
4const player = videojs('vid1'); // Initialize Video.js player
5player.eme(); // Enable EME (Encrypted Media Extensions) support for DRM playback
6player.src({
7src: `https://stream.fastpix.com/${PLAYBACK_ID}.m3u8?token=${DRM_LICENSE_TOKEN}`, // HLS stream URL with DRM token appended as query parameter
8type: 'application/x-mpegURL',
9keySystems: {
10'com.widevine.alpha': `https://api.fastpix.com/v1/on-demand/drm/license/widevine/${PLAYBACK_ID}?token=${DRM_LICENSE_TOKEN}`, // Widevine for Chrome, Android, and other compatible browsers
11'com.apple.fps.1_0': {
12certificateUri: `https://api.fastpix.com/v1/on-demand/drm/cert/fairplay/${PLAYBACK_ID}?token=${DRM_LICENSE_TOKEN}`, // FairPlay application certificate required by Safari to initiate DRM session
13licenseUri: `https://api.fastpix.com/v1/on-demand/drm/license/fairplay/${PLAYBACK_ID}?token=${DRM_LICENSE_TOKEN}`, // FairPlay license server to validate playback authorization
14}
15}
16});

Shaka Player (For Web)

1const PLAYBACK_ID = 'PLAYBACK_ID'; // Replace with actual playback ID
2const DRM_LICENSE_TOKEN = 'DRM_TOKEN'; // Replace with actual DRM license token
3
4const manifestUri = `https://stream.fastpix.com/${PLAYBACK_ID}.m3u8?token=${DRM_LICENSE_TOKEN}`;
5
6async function initApp() {
7// Install polyfills
8shaka.polyfill.installAll();
9
10if (shaka.Player.isBrowserSupported()) {
11initPlayer();
12} else {
13console.error('Shaka Player is not supported!');
14}
15}
16
17async function initPlayer() {
18const video = document.getElementById('video');
19const player = new shaka.Player(video);
20
21// DRM configuration
22player.configure({
23drm: {
24servers: {
25'com.widevine.alpha': `https://api.fastpix.com/v1/on-demand/drm/license/widevine/${PLAYBACK_ID}?token=${DRM_LICENSE_TOKEN}`,
26'com.apple.fps.1_0': `https://api.fastpix.com/v1/on-demand/drm/license/fairplay/${PLAYBACK_ID}?token=${DRM_LICENSE_TOKEN}`
27},
28advanced: {
29'com.apple.fps.1_0': {
30serverCertificateUri: `https://api.fastpix.com/v1/on-demand/drm/cert/fairplay/${PLAYBACK_ID}?token=${DRM_LICENSE_TOKEN}`
31}
32}
33}
34});
35
36try {
37await player.load(manifestUri);
38console.log('The video has now been loaded!');
39} catch (e) {
40console.error('Error loading video', e);
41}
42}
43
44initApp();

iOS Native (AVPlayer with FairPlay)

To use FairPlay on iOS, configure AVURLAsset and implement AVAssetResourceLoaderDelegate to handle SPC (Server Playback Context) and CKC (Content Key Context) exchange. Use the following endpoints:

  • Certificate URL:

    https://api.fastpix.com/v1/on-demand/drm/cert/fairplay/{playbackId}?token={drmToken}

  • License URL:

    https://api.fastpix.com/v1/on-demand/drm/license/fairplay/{playbackId}?token={drmToken}

Refer to Apple’s FairPlay documentation for detailed implementation.


VersaPlayer (For iOS)

1import VersaPlayer
2
3// Video player controller that integrates FairPlay DRM using VersaPlayer
4class VideoPlayerViewController: UIViewController,VersaPlayerDecryptionDelegate {
5
6// Function to initialize and configure the DRM-enabled player
7func initiatePlayer(videourl:String) {
8
9    let item = VersaPlayerItem(url: url)
10    item.isEncrypted = true
11    controls.handler.decryptionDelegate = self
12}
13
14//Provide the FairPlay Application Certificate
15// This certificate is used to generate the SPC (Server Playback Context) request
16func urlFor(player: VersaPlayer) -> URL {
17        
18            return URL(string: "https://api.fastpix.com/v1/on-demand/drm/cert/fairplay/{PLAYBACK_ID}?token={DRM_LICENSE_TOKEN}")!
19        
20}
21
22// Provide the unique Content Identifier for the video
23// This ID ties the playback request to the specific asset on the license server
24func contentIdFor(player: VersaPlayer) -> String {
25        let assetId: String = "CONTENT_ID"
26        return assetId
27}
28  
29// Provide the License Server URL (CKC URL)
30// The SPC generated with the certificate and content ID is sent here,
31// and the server responds with the CKC (Content Key Context)
32// which contains the decryption keys to unlock the video
33func contentKeyContextURLFor(player: VersaPlayer) -> URL {
34        
35            return URL(string: “https://api.fastpix.com/v1/on-demand/drm/license/fairplay/{PLAYBACK_ID}?token={DRM_LICENSE_TOKEN}")!
36
37 }
38
39
40}

ExoPlayer (For Android)

1playerView = findViewById(R.id.player_view); // Find the PlayerView from the layout
2player = ExoPlayer.Builder(this).build() // Create a new ExoPlayer instance
3playerView.player = player;  // Attach the player to the PlayerView so the UI can display it
4 // Build the MediaItem with HLS stream and Widevine DRM configuration
5val mediaItem = MediaItem.Builder()
6      // Set the media URI (HLS streaming URL with JWT token)
7    .setUri(" https://stream.fastpix.com/{PLAYBACK_ID}.m3u8?token={JWT} ")
8    // Configure DRM (Digital Rights Management) - Widevine in this case
9    .setDrmConfiguration(
10        MediaItem.DrmConfiguration.Builder(C.WIDEVINE_UUID)
11     // Set the license server URI with token
12            .setLicenseUri(" https://api.fastpix.com/v1/on-demand/drm/license/widevine/{PLAYBACK_ID}?token={DRM_LICENSE_TOKEN}")
13            .build()
14    )
15    .setMediaMetadata(MediaMetadata.Builder().setTitle("”).build()) //Set media metadata like the video title
16    .build()
17player.setMediaItem(mediaItem).   // Build the final MediaItem
18player.prepare() // Prepare the player (loads manifest and initializes playback)
19player.playWhenReady = true  // Start playback as soon as the player is ready

Supported & tested players

FastPix DRM is tested and confirmed to work with:

  • HLS.js
  • Video.js (with videojs-contrib-eme)
  • Shaka Player
  • iOS AVPlayer (FairPlay)
  • VersaPlayer
  • ExoPlayer (Android)

If your player supports Widevine, PlayReady, or FairPlay with CBCS encryption, there’s a strong chance it will work with FastPix DRM as well. We’re always expanding our test coverage - let us know if you’ve successfully integrated with another player so we can add it to our compatibility list.



Playback DRM Content with FastPix Player

If you’re using FastPix Player, the integration process is even simpler. FastPix Player handles license requests, decryption, and browser compatibility for you - with minimal setup.

How it works:

FastPix Player supports both Widevine and FairPlay natively. During playback, it:

  1. Automatically detects whether the video is encrypted.
  2. Sends a license request using the provided DRM token.
  3. Decrypts the video securely and plays it in the user’s browser.

Required tokens:

To play DRM-protected videos, you’ll need two secure JSON Web Tokens (JWTs):

  • token: Grants permission to stream the video.
  • drm-token: Authorizes access to the DRM license server.

You can generate both tokens using the JWT Token Generator.
If you enable the “DRM License” feature during generation, you can use the same token for both fields.


Embed example

Here’s a minimal HTML snippet using FastPix Player for DRM-protected playback:

1<fastpix-player
2  playback-id="YOUR-PLAYBACK-ID"
3  token="YOUR-DRM-TOKEN"
4  drm-token="YOUR-DRM-TOKEN">
5</fastpix-player>

Replace the placeholders with:

  • YOUR-PLAYBACK-ID: The unique ID of your video asset
  • YOUR-DRM-TOKEN: The token authorizing both playback and license access

Both token and drm-token are required. If either is missing or invalid, the player will display a clear error message to help you debug.


Browser support

FastPix Player’s DRM integration works across:

DRM SystemBrowser Support
WidevineChrome, Firefox, Edge, Brave, and others
FairPlaySafari on macOS and iOS


Testing DRM protection

To verify that DRM is functioning correctly, take a screenshot of the video playback. If DRM is properly enforced, the video should either be replaced by a black screen or display a single frame from the beginning of the video (instead of the actual content).


Need help?

Whether you’re using FastPix Player or a third-party player, we’re here to help you set up DRM right.
Email [email protected] for token generation tips, license configuration, or FairPlay certificate assistance.