DRM Policy

The DRM Policy view lets you store named sets of license parameters in Cloud DRM and reference them from your token, instead of writing every parameter by hand.

A DRM Policy holds protection settings only — the Widevine, PlayReady, and FairPlay parameters, including per-track rules. Claims that identify a single request, such as exp, kid, cid, ip, or nonce, always stay in the token.

How a policy is applied

Every license request resolves its parameters from three sources:

Source	Role
Default policy	The baseline for every request in your tenant. It holds the full parameter set.
Named policy	Applied on top when your token carries a drm_policy claim. It lists only the fields it changes.
Token claims	Applied last. A value set in the token wins over both policies.

A token without a drm_policy claim resolves against the Default policy alone, so existing tokens keep working exactly as before.

Understanding the policy list

The list shows every policy in the current tenant.

• Policy name: The value you put in the drm_policy claim.
• Description: Your own note about what the policy is for. Optional.
• Last modified: When the policy was last saved.
• Actions: Opens a menu with the actions available for that policy.

The Default policy is always present and marked with an icon. You can edit its configuration, but you can't rename or delete it.

To find a policy, enter part of its name in the Search field. The list is paginated, and you can change the number of rows shown per page.

Creating a policy

1. Click Create DRM Policy.
2. Enter a Policy Name.
3. Add a Description if you want one.
4. Choose a template, or click Start from scratch for an empty configuration.
5. Edit the configuration.
6. Add track-specific rules if your stream uses more than one key.
7. Click Create DRM Policy.

Naming rules

• Up to 20 characters.
• Unique within your tenant, ignoring case. If Strict already exists, creating strict is rejected.
• Matched without regard to case. A drm_policy claim of strict finds the policy named Strict.
• Default is reserved, in any capitalization.

caution

The name is the contract with your token. If you rename a policy, every token that references the old name stops matching it — and the request won't fail. It falls back to the Default policy instead, so the symptom is unexpected protection settings rather than an error. Treat the name as fixed once your tokens use it.

Starting from a template

Templates pre-fill the editor with a complete configuration you can then adjust.

Template	What it gives you	Security	Device compatibility
Relaxed	Software-only security tiers, no HDCP or output enforcement, the same protection for every track.	Low	High
Balanced	The Relaxed baseline plus top-level HDCP enforcement for Widevine and FairPlay, with persistence disabled across all DRM systems.	Medium	Medium
Strict	A hardware-tier baseline with HDCP, analog-output, and CGMS enforcement from Full HD upward, plus per-track rules that escalate protection for higher qualities.	High	Low

A template only pre-fills the editor. The policy you create isn't linked to it, so later changes to a template don't reach policies you already created.

You can also apply a template to an existing policy. Open the policy and click Choose template — this replaces the current configuration.

Writing the configuration

The Configuration box holds one object per DRM system: playReady, widevine, and fairplay.

The parameter names inside each object are the same ones you would write in a token. For the full list of parameters and their allowed values, see Token.

The editor validates as you type. Save changes stays disabled until the JSON is valid, and a misspelled parameter name is rejected rather than quietly ignored. Use Copy JSON to copy the configuration, for example to reuse it in another policy.

Leave out anything that identifies a single request. Expiry, key IDs, content ID, IP, nonce, request limit, and user or session identifiers belong in the token, not in a policy.

Per track-specific rules

If your stream is encrypted with a single key, keep Single-key selected and the configuration applies to every track.

Choose Multi-key to give different track types their own settings — for example hardware-level security on 4K while audio stays on the software tier.

1. Select Multi-key.
2. Click Add track rule.
3. Enter the track types the rule applies to in the Add Type... field.
4. Edit the JSON for that rule.

To remove a rule, click Delete rule.

A track type is matched against the intendedTrackType attribute your packager sends to the Cloud DRM key management system. It's a free-form string, matched case-sensitively, and neither side validates it, so a value that doesn't match anything simply never applies. AUDIO, VIDEO, SD, HD, FHD, and UHD are the recommended names.

caution

A track rule stored in a policy is applied after the top-level claims in your token, so it overrides them. To override a policy's track rule for a single request, use a tracks entry in the token rather than a top-level claim. For the full order in which sources are combined, see Using a DRM Policy.

Referencing a policy from a token

Add the drm_policy claim to your token payload and set it to the policy name:

{
  "exp": 1798671600,
  "kid": ["*"],
  "drm_policy": "strict"
}

Everything the policy doesn't set comes from the Default policy, and anything you write directly in the token overrides both.

caution

A name that doesn't match any policy — a typo, or a policy someone deleted — doesn't produce an error. The request falls back to the Default policy. If protection settings aren't what you expect, check which policy actually served the request in the Request Log.

Editing a policy

Open a policy from the list, change its name, description, or configuration, then click Save changes. The button stays disabled until you change something.

Changes apply to the next license request. Licenses already issued keep the parameters they were issued with.

Deleting a policy

caution

Before you confirm, the console tells you how many license requests referenced this policy over the last 30 days. Treat it as a hint, not a guarantee — your tokens are generated on your own backend, so Cloud DRM can't know for certain which policies are still in use.

1. Open the policy from the list.
2. Click Delete Policy.
3. Confirm.

Deleting a policy doesn't break playback. Tokens that still name it fall back to the Default policy.

Permissions

For a description of each role, see Members and roles.

Role	What it can do
Admin, Editor, DRM Admin	Create, edit, and delete policies.
Viewer, DRM Viewer	View policies and their configuration.
Content Provider, DRM Packager	No access to policies.