This guide walks you through configuring and applying DRM (Digital Rights Management) protection using the RMS Console.

This document covers the final step in the media protection workflow, focusing specifically on DRM implementation after you've already uploaded and processed your media for publishing.

In this article:

Step 1: Apply content key policies

Step 2: Verify encrypted playback

Tokens

Platform-specific behaviors

Playback URLs

Testing

Troubleshooting

Before you begin

• Configure DRM settings: DRM setup in RMS Console

• Process your media: RMS Console: Process media

As a user, you'll create a streaming locator for your output asset with processed media, applying protection through two key components: a streaming policy and a content key policy. This enables platform-specific DRM encryption capabilities:

• Widevine for Android/Chrome
• PlayReady for Edge/Windows
• FairPlay for Safari (iOS/macOS)

During playback, the encrypted media is decrypted using JWT (JSON Web Token), which verifies access rights through the appropriate DRM license service.

Step 1: Apply content key policies

To publish media with multi-DRM protection, follow these steps:

1. Navigate to the RMS Console > Assets and select an output asset with processed media.

2. Create a streaming locator.

3. From the dropdown list, select a streaming policy: Predefined_MultiDrmStreaming or Predefined_MultiDrmCencStreaming.

4. From the dropdown list, select a compatible сontent key policy for DRM.

5. Click Add.

Important:

• There are no Content key policies in the RMS Console by default. Custom creation via the Console will be available in a future update. Learn how to add them to your account.
• When selecting Predefined_MultiDrmCencStreaming  as your streaming policy, the FairPlay tab will not appear. This is because FairPlay requires CBCS (Cipher Block Chaining with Subsample Encryption) encryptioт, while this policy uses CENC (Common Encryption). Use Predefined_MultiDrmStreaming and a content key policy that supports all DRM technologies to enable FairPlay.
• For full compatibility across devices, it's recommended to use DASH for Widevine and PlayReady, and HLS for FairPlay.

Step 2: Verify encrypted playback

When testing across different browsers and devices, remember that DRM support varies by platform. Chrome and Edge support Widevine, while Safari requires FairPlay for protected content.

Tokens

The Console automatically generates Tokens valid for 1 hour since the page loads.

After you create a locator with a DRM policy, two tabs appear:

• Widevine
• FairPlay 

Platform-specific behaviors

The table below shows the key playback components in the RMS Console for each DRM platform:

Playback URLs

The playback URLs are available when selecting Show URLs.

Use the links with the generated tokens in any demo player, or use the built-in RMS Console Player to test playback with the current token.

Testing

Verify that playback fails without a valid token:

1. Modify the token value.

2. Click Refresh player.

3. Ensure no media is played.

If playback fails without a token but succeeds with the autogenerated one, your encryption setup is verified.

Troubleshooting

Encountering issues with encrypted media playback? Here are common problems and their solutions:

Missing token

Confirm you've applied the correct DRM-specific content key policy. Tokens won't appear if an AES-specific policy was used.

Playback error

If using a custom token, verify that it:

• Is not expired (check here).

• Has correct claims and permissions.

• Was generated for the selected locator.

• Follows JWT (token) standards.

If using the autogenerated token, verify that during [configuration], your EZDRM credentials and environment domain (forrms-domain) were correctly configured.

Contact us

If you've exhausted these troubleshooting steps and still cannot resolve the issue, contact Ravnur.

See more

• Create content key policy

• RMS Console: Encrypt media with AES ClearKey

• RMS Console: Publish Media