Protect videos with DRM

What is DRM?

DRM (Digital Rights Management) provides an extra layer of content security for video content streamed from Mux.

Leveraging DRM blocks or limits the impact of:

• Screen recording
• Screen sharing
• Downloading tools

This extra layer of security means that the segments of video that Mux delivers are encrypted using MPEG Common Encryption's CBCS mode (which uses AES symmetric cryptography), and an additional license request is required to deliver a decryption key to the video player to initiate playback.

Mux uses the industry standard protocols for delivering DRM protected video content, specifically Google Widevine, Microsoft PlayReady, and Apple FairPlay.

DRM requires the use of Signed URLs, and when combined with Domain and User-Agent restrictions, can provide a very strong content protection story, up to and including security levels that satisfy the requirements of Hollywood studios.

Prerequisites for FairPlay DRM on Apple devices

In order to play back DRM protected content on Safari on MacOS, or on any browser on iOS or iPadOS, a customer must work with Apple to obtain a FairPlay deployment package (also called a “FairPlay certificate”). Without this, DRM protected content will not be playable on these devices.

If you do not yet have a FairPlay certificate, Mux can provide documentation for this process; please reach out to Mux support for details.

Configure your account for DRM

Create a new environment for DRM testing

We strongly recommend using an isolated new environment for testing DRM protected content during the beta.

Once you've created the environment, switch into that environment, and copy the URL of your browser along with the name of the environment, it should look something like this:

"DRM test environment"
https://dashboard.mux.com/organizations/${ORG_ID}/environments/${ENV_ID}/video/assets

Send this to our support team, and we'll onboard you when there is availability.

Receive your DRM configuration ID

Once you're onboarded, we'll reply with a DRM configuration ID for this environment, you'll need this when you add a DRM playback ID to an asset. It'll look something like this: (you can't use this one, it's an example only)

2OkGwcOH3IRf1XLjB02vLv015qQaXal500sE5FGqHCVhe9gzYiV02IDTK02r00gorrmkA4jxYK27xzqLA

You can use the DRM Configurations APIAPI to list the DRM Configurations available to your account.

Create an asset or live stream with a DRM playback policy

Mux Video supports applying DRM to both live streams and assets.

Creating a DRM protected asset

To create an asset with DRM, you simply need to use the advanced_playback_policies field to provide the DRM playback policy, and the DRM configuration ID for this asset as shown below:

// POST /video/v1/assets
{
  "input": "https://storage.googleapis.com/muxdemofiles/mux.mp4",
  "advanced_playback_policies": [
    {
      "policy": "drm",
      "drm_configuration_id": "${DRM_CONFIGURATION_ID}"
    }
  ],
  "video_quality": "plus"
}

Notes:

• The asset must use the plus video quality level.
• You cannot use both the playback_policy field, and advanced_playback_policies field in the same request.
• You can retroactively add a DRM playback policy to an asset using the Playback IDs APIAPI, but only on assets that were created after you environment was enabled for DRM.

Creating a DRM protected live stream

As with creating an asset with DRM, the DRM playback policy, and the DRM configuration ID must be set in the advanced_playback_policies of the live stream.

In the example below, we also set the new_asset_settings to also use DRM, so any DVR assets and on-demand assets also have DRM applied.

// POST /video/v1/live-streams
{
  "advanced_playback_policies": [
    {
      "policy": "drm",
      "drm_configuration_id": "${DRM_CONFIGURATION_ID}"
    }
  ],
  "new_asset_settings": {
    "advanced_playback_policies": [
      {
        "policy": "drm",
        "drm_configuration_id": "${DRM_CONFIGURATION_ID}"
      }
    ]
  }
}

Play DRM protected videos

Sign the playback token

All assets ingested with DRM are required to be played back using signed URLs, so you'll need to create a JWT to play back this asset.

You can use any of the normal URL signing tools to generate this token.

Sign a DRM license token

For DRM protected content to playback, a signed license URL is required in addition to the normal playback token.

This second token is structured in the same way as other Mux Video tokens, with the exception that the aud must be set to d (drm-license).

We've added support for signing a license to Mux Node SDK from version 8.8.0. For other languages, any of the other documented languages and libraries should work. You can find an example node script for signing DRM licenses here.

We have updated our online signing tool to help you sign licenses for testing.

Playback in Mux Player

We officially support DRM in Mux Player for Web, iOS, and Android.

Mux Player Web

Support for DRM in Mux Player was added in version 2.8.0.

To play back DRM protected content, you should instantiate the player with the new drm-token parameter set to the DRM license token that you previously generated as follows:

<!-- How you load the player will vary depending on how you build your application -->
<script src="https://cdn.jsdelivr.net/npm/@mux/mux-player"></script>
<mux-player
      playback-id="Playback ID here"
      playback-token="Playback token here"
      drm-token="DRM license token here"
      thumbnail-token="Thumbnail token here"
      storyboard-token="Storyboard token here"
    ></mux-player>

You can see a demo of this working in codesandbox here.

For react environments, you should set drm in the tokens prop:

<MuxPlayer
  playbackId="Playback ID here"
  tokens={{
    playback: "Playback token here",
    thumbnail: "Thumbnail token here",
    storyboard: "Storyboard token here",
    drm: "DRM license token here"
  }}
/>

With your new tokens all wired up correctly, you should be able to play back your freshly DRM protected content as you'd normally expect!

Here's a demo page with some pre-prepared DRM protected content you can also test a device against.

Full documentation for using DRM with Mux Player for web can be found here.

Mux Player iOS

Support for DRM in Mux Player for iOS was added in version 1.1.0.

The DRM license token can be configured on PlaybackOptions using the following API:

let playbackOptions = PlaybackOptions(
  drmToken: "DRM license token here", 
  playbackToken: "Playback token here"
)
let player = AVPlayer(
  playbackID: "Playback ID here",
  playbackOptions: playbackOptions
)

Full documentation for using DRM Mux Player for iOS can be found here.

Mux Player Android

Support for DRM in Mux Player for Android was added in version 1.1.0.

The DRM license token can be configured when instantiating a MediaItem using the MediaItems factory class as follows:

// You don't need to add your own DrmSessionManager, we take care of this
val player = // Whatever you were already doing
val mediaItem = MediaItems.mediaItemFromPlaybackId(
  playbackId = "Playback ID here",
  playbackToken = "Playback token here",
  drmToken = "DRM license token here"
)
// Normal media3 boilerplate
player.setMediaItem(mediaItem)
player.prepare()

Full documentation for using DRM Mux Player for Android can be found here.

Playback in non-Mux Player environments

Mux's DRM is compatible with a wide range of devices, players, and platforms outside of Mux Player.

If you're using another video player that isn't listed below, please contact support for documentation on how to integrate.

Roku

In order to play back DRM protected content in Roku, you simply need to add your DRM Configuration to your content node. This includes the following:

1. To your channel's manifest, you need to add the following two fields:

requires_widevine_drm=1
requires_widevine_version=1.0

2. When preparing your contentNode, ensure you reference the DRM configuration and license URL as follows:

drmParams = {
  keySystem: "Widevine",
  licenseServerURL: "https://license.mux.com/license/widevine/${PLAYBACK_ID}?token=${DRM_LICENSE_JWT}"
}
contentNode = CreateObject("roSGNode", "ContentNode")
contentNode.url = "<content URL>"
contentNode.drmParams = drmParams
contentNode.title = "<your title>"
contentNode.length = <duration in seconds>
' other contentNode properties can be added here, 
' then play your video as you normally would

Testing that DRM is working

Checking your video is DRM protected is pretty simple: just take a screenshot! If DRM is working correctly, you should expect to see the video replaced with either a black rectangle, or a single frame from the start of the video.

Configure DRM security levels

Currently Mux's DRM feature defaults to a balance of security and playability, including automatically leveraging higher security levels on devices where this is available.

At times customers may want to adjust this balance to increase security levels, specifically for example to meet contractual Hollywood studio security requirements. Please contact us if you need to discuss or adjust the security levels used.

In the future, we will allow self-serve adjustment of security levels through the DRM Configurations API.

In line with common industry practices, only video tracks are currently DRM protected, meaning that audio-only assets and live streams are not protected by DRM.

Known limitations

• DRM protected content is not supported on Chromecast and the Chromecast button is hidden from Mux player
  • We're exploring the work required for supporting DRM on Chromecast via a custom receiver app

Pricing

DRM is an add-on feature to Mux Video, with a starting price of $0.006 “per license”, and discounts available for high volumes. What does this mean for you? For the majority of customers, 1 video view is equivalent to 1 license. For customers who are licensing premium content in higher resolutions like 2K or 4K, a view may consume several licenses.

We'd love to chat about DRM pricing, reach out to us if you have questions about pricing or chat with your account team.