FirstByte Stream can encrypt your media with Common Encryption (CENC), scheme cbcs. One encrypted copy serves every playback path (MoQ, HLS and DASH) and every key system (Clear Key, Widevine, PlayReady and FairPlay). The relays only carry encrypted media. They never have the keys.

​
Key systems

Without a DRM vendor, protected media uses Clear Key. When you connect a vendor (see DRM provider), the player uses the best key system that the viewer’s browser supports.

​
Turn on DRM for a recorded asset

Before you turn on DRM, make sure that:
  • your organization has an active Ed25519 playback signing key,
  • Auto-transcode (ABR) is on in the VOD defaults.
Then open the asset’s playback endpoints and turn on DRM, or use the API:
The asset is encoded again. It is not available until the new encode is ready. After that:
  • The player gets its keys from /api/streams/playback/<pb>/license (or from the license proxy for a vendor key system), with a playback token.
  • /source, the MP4 download and assets.playbackUrl refuse a DRM asset, because they would give the clear original.

​
Turn on DRM for a live input

Live DRM works for inputs that you publish over RTMP or SRT. The ingest encrypts the media before the stream gets to a relay. Open the live input and turn on DRM in the DRM card, or use the API:
  • The change applies at the next publish. If the input is live now, stop the encoder and start it again.
  • The input then refuses publishing over WHIP and MoQ, because those paths cannot be encrypted by the platform. Use RTMP or SRT.
  • If the platform cannot load the input’s keys, it refuses the encoder (ingest error drm_keys_unavailable). It never publishes a DRM input in the clear.
  • When you turn DRM off, the keys stay stored. If you turn DRM on again, the same keys are used.

​
What the viewer needs

The <clutchcall-player> element and StreamPlayer do DRM by themselves. The browser must support Encrypted Media Extensions (EME).
  • For a protected asset, the player never falls back to a clear path. If the browser cannot decrypt, the player shows an error.
  • Safari without a FairPlay vendor cannot play Clear Key through native HLS.

​
DRM provider

A DRM vendor gives Widevine, PlayReady and FairPlay licenses. Connect one in Settings → Content protection, or with streams.drm.setProvider. Only an owner or an admin can change it. All URLs must start with https:// and must not point at a private address. Use Test provider (streams.drm.testProvider) to check the CPIX connection before you save.

​
How licensing works with a vendor

The player sends its license request to the platform’s license proxy, not to the vendor:
The proxy checks the viewer’s playback token, adds your sealed vendor credentials, and sends the request to the vendor. Your vendor credentials never get to the browser.

​
Limits

  • Keys that were made before you connected a provider stay Clear Key keys. Turn DRM off and on again for an asset to get vendor keys.
  • The CPIX client accepts keys in plain text over TLS. It refuses keys that are encrypted with a document key.
  • Vendors that need a new token for each license request are not supported. Only fixed credential headers are supported.
  • Live inputs carry only the common pssh box in the init segment.