Learn how to leverage Digital Rights Management (DRM) to protect your videos
What is DRM?
Prerequisites for FairPlay DRM on Apple devices
Configure your account for DRM
Create an asset or live stream with a DRM playback policy
Play DRM protected videos
Configure DRM security levels
Known limitations
Pricing
Mux Video's DRM feature is currently in beta, and is not covered by Mux's support SLAs. You should take this into account when considering using this feature for production traffic. You can request access to DRM from the betas page.
Check out our blog on “What is DRM” to learn more about the concepts of DRM.
DRM (Digital Rights Management) provides an extra layer of content security for video content streamed from Mux.
Leveraging DRM blocks or limits the impact of:
This extra layer of security means that the segments of video that Mux delivers are encrypted using MPEG Common Encryption's CBCS mode (which uses AES symmetric cryptography), and an additional license request is required to deliver a decryption key to the video player to initiate playback.
Mux uses the industry standard protocols for delivering DRM protected video content, specifically Google Widevine, Microsoft PlayReady, and Apple FairPlay.
DRM requires the use of Signed URLs, and when combined with Domain and User-Agent restrictions, can provide a very strong content protection story, up to and including security levels that satisfy the requirements of Hollywood studios.
In order to play back DRM protected content on Safari on MacOS, or on any browser on iOS or iPadOS, a customer must work with Apple to obtain a FairPlay deployment package (also called a “FairPlay certificate”). Without this, DRM protected content will not be playable on these devices.
If you do not yet have a FairPlay certificate, Mux can provide documentation for this process; please reach out to Mux support for details.
We strongly recommend using an isolated new environment for testing DRM protected content during the beta.
Once you've created the environment, switch into that environment, and copy the URL of your browser along with the name of the environment, it should look something like this:
"DRM test environment"
https://dashboard.mux.com/organizations/${ORG_ID}/environments/${ENV_ID}/video/assetsSend this to our support team, and we'll onboard you when there is availability.
Once you're onboarded, we'll reply with a DRM configuration ID for this environment, you'll need this when you add a DRM playback ID to an asset. It'll look something like this: (you can't use this one, it's an example only)
2OkGwcOH3IRf1XLjB02vLv015qQaXal500sE5FGqHCVhe9gzYiV02IDTK02r00gorrmkA4jxYK27xzqLAYou can use the DRM Configurations APIAPI to list the DRM Configurations available to your account.
Mux Video supports applying DRM to both live streams and assets.
To create an asset with DRM, you simply need to use the advanced_playback_policies field to provide the DRM playback policy, and the DRM configuration ID for this asset as shown below:
// POST /video/v1/assets
{
"input": "https://storage.googleapis.com/muxdemofiles/mux.mp4",
"advanced_playback_policies": [
{
"policy": "drm",
"drm_configuration_id": "${DRM_CONFIGURATION_ID}"
}
],
"video_quality": "plus"
}Notes:
plus video quality level.playback_policy field, and advanced_playback_policies field in the same request.As with creating an asset with DRM, the DRM playback policy, and the DRM configuration ID must be set in the advanced_playback_policies of the live stream.
In the example below, we also set the new_asset_settings to also use DRM, so any DVR assets and on-demand assets also have DRM applied.
// POST /video/v1/live-streams
{
"advanced_playback_policies": [
{
"policy": "drm",
"drm_configuration_id": "${DRM_CONFIGURATION_ID}"
}
],
"new_asset_settings": {
"advanced_playback_policies": [
{
"policy": "drm",
"drm_configuration_id": "${DRM_CONFIGURATION_ID}"
}
]
}
}All assets ingested with DRM are required to be played back using signed URLs, so you'll need to create a JWT to play back this asset.
You can use any of the normal URL signing tools to generate this token.
For DRM protected content to playback, a signed license URL is required in addition to the normal playback token.
This second token is structured in the same way as other Mux Video tokens, with the exception that the aud must be set to d (drm-license).
We've added support for signing a license to Mux Node SDK from version 8.8.0. For other languages, any of the other documented languages and libraries should work. You can find an example node script for signing DRM licenses here.
We have updated our online signing tool to help you sign licenses for testing.
We officially support DRM in Mux Player for Web, iOS, and Android.
Support for DRM in Mux Player was added in version 2.8.0.
To play back DRM protected content, you should instantiate the player with the new drm-token parameter set to the DRM license token that you previously generated as follows:
<!-- How you load the player will vary depending on how you build your application -->
<script src="https://cdn.jsdelivr.net/npm/@mux/mux-player"></script>
<mux-player
playback-id="Playback ID here"
playback-token="Playback token here"
drm-token="DRM license token here"
thumbnail-token="Thumbnail token here"
storyboard-token="Storyboard token here"
></mux-player>You can see a demo of this working in codesandbox here.
For react environments, you should set drm in the tokens prop:
<MuxPlayer
playbackId="Playback ID here"
tokens={{
playback: "Playback token here",
thumbnail: "Thumbnail token here",
storyboard: "Storyboard token here",
drm: "DRM license token here"
}}
/>With your new tokens all wired up correctly, you should be able to play back your freshly DRM protected content as you'd normally expect!
Here's a demo page with some pre-prepared DRM protected content you can also test a device against.
Full documentation for using DRM with Mux Player for web can be found here.
Support for DRM in Mux Player for iOS was added in version 1.1.0.
The DRM license token can be configured on PlaybackOptions using the following API:
let playbackOptions = PlaybackOptions(
drmToken: "DRM license token here",
playbackToken: "Playback token here"
)
let player = AVPlayer(
playbackID: "Playback ID here",
playbackOptions: playbackOptions
)Full documentation for using DRM Mux Player for iOS can be found here.
Support for DRM in Mux Player for Android was added in version 1.1.0.
The DRM license token can be configured when instantiating a MediaItem using the MediaItems factory class as follows:
// You don't need to add your own DrmSessionManager, we take care of this
val player = // Whatever you were already doing
val mediaItem = MediaItems.mediaItemFromPlaybackId(
playbackId = "Playback ID here",
playbackToken = "Playback token here",
drmToken = "DRM license token here"
)
// Normal media3 boilerplate
player.setMediaItem(mediaItem)
player.prepare()Full documentation for using DRM Mux Player for Android can be found here.
Mux's DRM is compatible with a wide range of devices, players, and platforms outside of Mux Player.
If you're using another video player that isn't listed below, please contact support for documentation on how to integrate.
In order to play back DRM protected content in Roku, you simply need to add your DRM Configuration to your content node. This includes the following:
requires_widevine_drm=1
requires_widevine_version=1.0contentNode, ensure you reference the DRM configuration and license URL as follows:drmParams = {
keySystem: "Widevine",
licenseServerURL: "https://license.mux.com/license/widevine/${PLAYBACK_ID}?token=${DRM_LICENSE_JWT}"
}
contentNode = CreateObject("roSGNode", "ContentNode")
contentNode.url = "<content URL>"
contentNode.drmParams = drmParams
contentNode.title = "<your title>"
contentNode.length = <duration in seconds>
' other contentNode properties can be added here,
' then play your video as you normally wouldMux Video's DRM feature is in beta, and generic integrations may not be fully supported by the Mux support team.
Mux Video uses three industry standard DRM technologies to deliver DRM protected videos: Google's Widevine, Apple's FairPlay, and Microsoft's PlayReady.
To use Mux's DRM with a third party player, you will need to pass the player a signed DRM license URL alongside your playback (manifest) URL. The exact names of the fields or APIs required to pass these parameters to the player do this vary, so you should consult your player documentation for full details.
To play DRM protected content using the Widevine protection scheme, a single license URL is required. The format of the Widevine license URL is shown below:
https://license.mux.com/license/widevine/${PLAYBACK_ID}?token=${DRM_LICENSE_JWT}You should substitute in the playback ID assigned to the asset or live stream into the license URL, as when constructing a playback URL.
It is mandatory to supply the appropriate JWT in the token parameter. For more details on generating this token, see the Sign a DRM license token section above.
To play DRM protected content using the FairPlay protection scheme, both a license URL, and an application certificate URL are required. The format of the license and application certificate URLs are shown below:
// Application Certificate
https://license.mux.com/appcert/fairplay/${PLAYBACK_ID}?token=${DRM_LICENSE_JWT}
// License
https://license.mux.com/license/fairplay/${PLAYBACK_ID}?token=${DRM_LICENSE_JWT}You should substitute in the playback ID assigned to the asset or live stream into the license and application certificate URL, as when constructing a playback URL.
It is mandatory to supply the appropriate JWT in the token parameter for both requests. For more details on generating this token, see the Sign a DRM license token section above.
To play DRM protected content using the PlayReady protection scheme, a single license URL is required. The format of the PlayReady license URL is shown below:
https://license.mux.com/license/playready/${PLAYBACK_ID}?token=${DRM_LICENSE_JWT}You should substitute in the playback ID assigned to the asset or live stream into the license URL, as when constructing a playback URL.
It is mandatory to supply the appropriate JWT in the token parameter. For more details on generating this token, see the Sign a DRM license token section above.
Checking your video is DRM protected is pretty simple: just take a screenshot! If DRM is working correctly, you should expect to see the video replaced with either a black rectangle, or a single frame from the start of the video.
Currently Mux's DRM feature defaults to a balance of security and playability, including automatically leveraging higher security levels on devices where this is available.
At times customers may want to adjust this balance to increase security levels, specifically for example to meet contractual Hollywood studio security requirements. Please contact us if you need to discuss or adjust the security levels used.
In the future, we will allow self-serve adjustment of security levels through the DRM Configurations API.
In line with common industry practices, only video tracks are currently DRM protected, meaning that audio-only assets and live streams are not protected by DRM.
DRM is an add-on feature to Mux Video, with a $100/month access fee + $0.006 "per license", and discounts available for high volumes. What does this mean for you? For the majority of customers, 1 video view is equivalent to 1 license. For customers who are licensing premium content in higher resolutions like 2K or 4K, a view may consume several licenses.
We'd love to chat about DRM pricing, reach out to us if you have questions about pricing or chat with your account team.