#DRM & Encryption

Transcodely supports industry-standard DRM (Digital Rights Management) for protecting premium video content. DRM encryption is configured at the output level and is available for streaming formats only: hls, dash, and adaptive.

HLS DRM is not yet fully wired. Jobs with DRM on hls (or the HLS side of adaptive) complete successfully, but the generated HLS playlists do not emit encryption signaling (#EXT-X-KEY / #EXT-X-SESSION-KEY), so the HLS rendition is effectively undecryptable. DASH DRM (ContentProtection in the MPD) is the verified, working path. Because adaptive produces both an HLS and a DASH manifest from shared CMAF segments, only its DASH rendition is currently protected. Use dash for production DRM until HLS DRM signaling lands.

DRM is configured via the drm object on an Output Specification. You provide the DRM systems to use, the encryption scheme, and either your own encryption keys (BYOK) or a key server URL.

DRM adds a 1.25x feature multiplier to the output cost. See Pricing for details.

#The DRMConfig object

{
  "drm": {
    "systems": ["widevine", "fairplay"],
    "scheme": "cbcs",
    "key_server": {
      "license_server_url": "https://drm.example.com/v1/keys"
    }
  }
}

#DRM systems

Transcodely supports the three major DRM systems. Specify one or more in the systems array.

For maximum device coverage, use all three systems:

{
  "systems": ["widevine", "fairplay", "playready"]
}

#Encryption schemes

The encryption scheme determines how media samples are encrypted. Your choice of scheme must be compatible with the DRM systems you select.

#Compatibility matrix

Use cbcs when targeting multiple DRM systems including FairPlay. Use cenc only when targeting Widevine and/or PlayReady without FairPlay.

#Bring Your Own Key

Use BYOK when you manage your own encryption keys. This gives you full control over key rotation and distribution.

#Widevine BYOK

A Widevine-only configuration using the CENC scheme. Supply your key_id and key as 32-character hex strings, plus a Base64 pssh_widevine box so players can acquire a license.

{
  "drm": {
    "systems": ["widevine"],
    "scheme": "cenc",
    "byok": {
      "key_id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
      "key": "f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1",
      "pssh_widevine": "AAAAQ3Bzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAADMIARIQobLD1OX2p7jJ0OHyprTF1hoLdHJhbnNjb2RlbHkiEKGyw9Tl9qe4ydDh8qa0xdY="
    }
  }
}

#Multi-DRM BYOK with CBCS

One CBCS key shared across Widevine, PlayReady, and FairPlay. Provide each system’s signaling — pssh_widevine, pssh_playready, and the FairPlay fairplay_iv/fairplay_uri — alongside the shared key_id and key.

{
  "drm": {
    "systems": ["widevine", "fairplay", "playready"],
    "scheme": "cbcs",
    "byok": {
      "key_id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
      "key": "f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1",
      "pssh_widevine": "AAAAQ3Bzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAADMIARIQobLD1OX2p7jJ0OHyprTF1hoLdHJhbnNjb2RlbHkiEKGyw9Tl9qe4ydDh8qa0xdY=",
      "pssh_playready": "AAACJnBzc2gAAAAAmgTweZhAQoarkuZb4IhflQAAAgYGAgAAAQABAPwBPABXAFIATQBIAEUAQQBEAEUAUgAgAHgAbQBsAG4AcwA9ACIAaAB0AHQAcAA6AC8ALwBzAGMAaABlAG0AYQBzAC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAEQAUgBNAC8AMgAwADAANwAvADAAMwAvAFAAbABhAHkAUgBlAGEAZAB5AEgAZQBhAGQAZQByACIAIAB2AGUAcgBzAGkAbwBuAD0AIgA0AC4AMAAuADAALgAwACIAPgA8AEQAQQBUAEEAPgA8AFAAUgBPAFQARQBDAFQASQBOAEYATwA+ADwASwBFAFkATABFAE4APgAxADYAPAAvAEsARQBZAEwARQBOAD4APABBAEwARwBJAEQAPgBBAEUAUwBDAFQAUgA8AC8AQQBMAEcASQBEAD4APAAvAFAAUgBPAFQARQBDAFQASQBOAEYATwA+ADwASwBJAEQAPgAxAE0ATwB5AG8AZABUADIAcABmAGoASgAwAE8ASAB5AHAAcgBUAEYAMQBnAD0APQA8AC8ASwBJAEQAPgA8AC8ARABBAFQAQQA+ADwALwBXAFIATQBIAEUAQQBEAEUAUgA+AA==",
      "fairplay_iv": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
      "fairplay_uri": "skd://license.example.com/a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6"
    }
  }
}

#Key server

Use a key server when you want your DRM provider to manage key generation and delivery. Transcodely fetches encryption keys from your key server during packaging.

{
  "drm": {
    "systems": ["widevine", "fairplay"],
    "scheme": "cbcs",
    "key_server": {
      "license_server_url": "https://drm.example.com/v1/keys",
      "auth_token": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
      "content_id": "movie_2025_summer_release"
    }
  }
}

#Clear lead

The clear_lead_seconds field specifies how many seconds at the beginning of the stream remain unencrypted. This is useful for:

• Ad insertion — pre-roll ads can be served from an unencrypted segment without requiring a DRM license
• Preview clips — allow viewers to sample content before DRM authentication

The value must be between 0 and 30 seconds. When omitted, it defaults to 0 (the entire stream is encrypted).

{
  "drm": {
    "systems": ["widevine", "fairplay"],
    "scheme": "cbcs",
    "key_server": {
      "license_server_url": "https://drm.example.com/v1/keys"
    },
    "clear_lead_seconds": 10
  }
}

#Complete example

A full dash output specification that layers several DRM building blocks onto an adaptive package. This uses dash, the verified DRM path (see the HLS DRM note above):

• An H.264 ABR ladder at 1080p, 720p, and 480p, mixing standard and economy quality tiers.
• Two audio tracks — English (default) and Spanish — packaged alongside the video.
• Multi-DRM across all three systems under one CBCS BYOK key, with a 5-second clear_lead_seconds so a pre-roll can play before encryption begins.

{
  "type": "dash",
  "video": [
    {"codec": "h264", "resolution": "1080p", "quality": "standard"},
    {"codec": "h264", "resolution": "720p", "quality": "standard"},
    {"codec": "h264", "resolution": "480p", "quality": "economy"}
  ],
  "audio": [
    {"language": "eng", "label": "English", "is_default": true},
    {"language": "spa", "label": "Spanish"}
  ],
  "drm": {
    "systems": ["widevine", "fairplay", "playready"],
    "scheme": "cbcs",
    "byok": {
      "key_id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
      "key": "f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1",
      "pssh_widevine": "AAAAQ3Bzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7Q...",
      "fairplay_iv": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
      "fairplay_uri": "skd://license.example.com/a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6"
    },
    "clear_lead_seconds": 5
  }
}

#Validation rules

Transcodely validates DRM configuration at job creation time. The following constraints are enforced: