Skip to main content

FairPlay DRM - License Acquisition Example

This guide walks you through acquiring a FairPlay license for HLS streams encrypted with Apple FairPlay DRM.

Sample Encrypted HLS Stream​

Use the following FairPlay-encrypted HLS stream:

https://e09f957480c8b1e479a1edb0fabc72d8.egress.mediapackage-vod.eu-west-1.amazonaws.com/out/v1/6f12444e793e4206ad363f810cb2aead/9ea4e8148b794c8ba2c6295b824e5ad5/46a61bf2c081464bb9476f2a55a06f48/index.m3u8

FairPlay Certificate​

To play FairPlay content, the player must download an Apple-issued FairPlay certificate.

  • Production: Obtain your certificate via the Apple Developer Console.

  • Testing: Use the temporary certificate available in the Web Console under:

    DRM → Configuration → License Acquisition → FairPlay Certificate

License Request Headers​

The player must attach the following custom HTTP headers to the license request:

  • BrandGuid – Sandbox value for testing
  • UserToken – JWT token
  • KID – Key ID identifying the content key
  • IV (optional) – Initialization Vector

👉 See FairPlay Additional Information for how to extract KID and IV.

Test Players​

InsysPlayer​

Test the stream using InsysPlayer on Safari (Mac only):

👉 Launch InsysPlayer

JWPlayer​

Use JWPlayer’s stream tester:

  • Player: JWPlayer Stream Tester
  • File URL: https://e09f957480c8b1e479a1edb0fabc72d8.egress.mediapackage-vod.eu-west-1.amazonaws.com/out/v1/6f12444e79macdf3e4206ad363f810cb2aead/9ea4e8148b794c8ba2c6295b824e5ad5/46a61bf2c081464bb9476f2a55a06f48/index.m3u8
  • Certificate URL:
    https://customer-tests.la.drm.cloud/certificate/fairplay?BrandGuid=5a96a0d0-d13f-42b0-ab2b-ba8cfc4aa0a0
  • License URL:
    https://customer-tests.la.drm.cloud/acquire-license/fairplay?KID=4376a4b3-d8ef-4f21-9a6b-faa81a2e59e3&brandguid=5a96a0d0-d13f-42b0-ab2b-ba8cfc4aa0a0&usertoken=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE3MzU2ODk2MDAsImRybVRva2VuSW5mbyI6eyJleHAiOiIyMDI1LTEyLTA3VDE1OjMwOjA5LjU5MDgxMjUrMDE6MDAiLCJraWQiOlsiKiJdLCJwIjp7InBlcnMiOnRydWUsImVkIjoiMjAyNS0xMi0wN1QxNTozMDowOS41OTExMzA1KzAxOjAwIn19fQ.xEToUttAk9AVFgP3bHyDlcvm6BR-8_hsl8V3n-jrDwM

ShakaPlayer​

Use ShakaPlayer demo:

👉 ShakaPlayer Demo

Setup Instructions:​

  1. Disable ad blockers.
  2. Go to CUSTOM CONTENT tab.
  3. Click the blue ➕ button.
  4. Fill in the modal:
  • Manifest URL: https://e09f957480c8b1e479a1edb0fabc72d8.egress.mediapackage-vod.eu-west-1.amazonaws.com/out/v1/6f12444e79macdf3e4206ad363f810cb2aead/9ea4e8148b794c8ba2c6295b824e5ad5/46a61bf2c081464bb9476f2a55a06f48/index.m3u8
  • Name: DEMO
  • Custom License Server URL: 
    https://customer-tests.la.drm.cloud/acquire-license/fairplay?KID=4376a4b3-d8ef-4f21-9a6b-faa81a2e59e3&brandguid=5a96a0d0-d13f-42b0-ab2b-ba8cfc4aa0a0&usertoken=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE3MzU2ODk2MDAsImRybVRva2VuSW5mbyI6eyJleHAiOiIyMDI1LTEyLTA3VDE1OjMwOjA5LjU5MDgxMjUrMDE6MDAiLCJraWQiOlsiKiJdLCJwIjp7InBlcnMiOnRydWUsImVkIjoiMjAyNS0xMi0wN1QxNTozMDowOS41OTExMzA1KzAxOjAwIn19fQ.xEToUttAk9AVFgP3bHyDlcvm6BR-8_hsl8V3n-jrDwM
  • Custom Certificate URL:
    https://customer-tests.la.drm.cloud/certificate/fairplay?BrandGuid=5a96a0d0-d13f-42b0-ab2b-ba8cfc4aa0a0

FairPlay Additional Information​

FairPlay license requests use a KID and an IV from the #EXT-X-KEY tag of the M3U8 chunklist — the KID in the URI, the IV in the tag's IV attribute:

#EXTM3U
#EXT-X-KEY:METHOD=SAMPLE-AES,URI="skd://drm.cloud.insysvt.com/acquire-license/fairplay?KID=4376a4b3-d8ef-4f21-9a6b-faa81a2e59e3",KEYFORMAT="com.apple.streamingkeydelivery",KEYFORMATVERSIONS="1",IV=0x1F3A1D7CE87A4CD3846038FCF4D05F82

Build the license URL from your License Acquisition URL by adding the KID and the IV. Don't just turn the skd:// URI into https://.

https://drm.cloud.insysvt.com/acquire-license/fairplay?KID=4376a4b3-d8ef-4f21-9a6b-faa81a2e59e3&IV=1f3a1d7ce87a4cd3846038fcf4d05f82

License Request Formats​

The license request (SPC payload) can use the following Content-Type headers:

  • application/x-www-form-urlencoded → spc=<encoded body>
  • multipart/form-data → SPC field in form
  • application/octet-stream → binary SPC data

License Response Formats​

  • If Accept: application/json → response:
    { "ckc": "<base64-encoded CKC>" }
  • Otherwise → binary CKC with Content-Type: application/octet-stream