Concepts

The four ideas worth understanding before you protect your first title.

The contentId is permanent #

It is your identifier for a title: the one you already use in your catalogue. You choose it, not us.

It cannot be reused. Ever.

Once a key has been issued for a contentId, the DRM provider will not issue another one for that identifier. Burn it by accident — a test, a typo — and that identifier is spent for good; you will have to repackage the title under a different name.

So treat it as what it is: a catalogue identifier, not a temporary filename. That is also why the dashboard warns you before creating.

Which characters are allowed

Letters, digits, dot, dash and underscore. No spaces, no accents, no colons. The restriction is not arbitrary: the identifier travels inside XML, and we use the colon internally as a separator.

For testing, use disposable identifiers

Something like test-2026-07-31-01. That way you do not spend real catalogue names while experimenting.

Key ID and key are not the same thing #

Every key is really two values, and confusing them is a security problem.

	What it is	Secret?
`keyId`	The key identifier	No. It travels in the clear inside the video itself, and it must: it is what the player uses to request the right license.
`key`	The key that decrypts the video	Completely. Anyone holding it can decrypt your content without asking anybody.

The key must never reach a browser

Not in JavaScript, not in a public API response, not in a repository. Only your packager needs it, on the server, at the moment of encryption.

We never store the key at all: we re-request it from the provider each time you ask. The only thing we persist is the map from your contentId to its keyId.

One key per quality #

You can protect a whole title with a single key, or give each quality its own. The difference is not cosmetic.

Playback rules apply per key. If 4K and 720p share a key, they share rules: either you demand hardware-backed devices for both — shutting out a lot of people on 720p — or you demand it for neither, and serve your 4K with no real protection.

One key per quality lets you do what you actually want: 4K only on certified devices, 720p anywhere.

Quality	Usual resolution	Typical level
`UHD`	8K and above	Strict
`UHD1`	4K (2160p)	Strict
`HD`	1080p	Balanced
`SD`	720p and below	Compatible
`AUDIO`	Sound track	Compatible

The resolutions are a convention, not a rule

We do not check your video’s resolution. A quality is a label you also give your packager, so all that matters is using the same one in both places. If your ladder is 1080p and 720p, call them HD and SD and be done.

Security levels: the trade-off #

More security always means fewer devices can play. No option is better at everything, and picking the strictest one just in case is the usual way to end up with support tickets nobody can diagnose.

Level	What it demands	Where it plays
Strict	End-to-end hardware protection and a protected video output (HDCP 2.2)	Modern phones and TVs. Rules out desktop browsers and older hardware.
Balanced	Hardware crypto, without requiring the whole chain	Most current phones, TVs and browsers.
Compatible	Nothing in particular	Practically everything, desktop browsers and old hardware included.

Behind each level there are concrete values, different for every DRM system. You can see them on the rules page in the dashboard and tune them one by one. What they mean exactly is in DRM systems.

What studios require

If you distribute licensed content, the studio usually mandates a minimum level per resolution. That requirement overrides any recommendation of ours.

Key rotation (live) #

On a live stream you can change the key periodically, so a leaked key is worth a few minutes of broadcast rather than the whole channel. We call each stretch a period.

Old keys keep working: someone who scrubs back, or watches the recording, can still decrypt the older segments with the key that belongs to them. Rotating does not erase the past.

Do not mix rotation with a regular key

If a title already has a regular (VOD) key and you add a rotation period, the provider makes that regular key permanently unusable. Anything encrypted with it stops playing. That is why we return a 409 if you try, instead of letting you break it.

The practical rule: decide up front whether a title is a rotating live stream or a fixed-key VOD. You cannot change your mind afterwards.

Rotation costs money

Every period is a new key and is billed as one. A channel rotating every 10 minutes produces 144 keys a day — around $43 a month. Match the period length to what you actually need.

Namespace and credentials #

Your account has a namespace (something like usr_a1b2c3d4). It is the boundary of your data: your keys, rules, playbacks and balance all hang off it.

Every credential you create is confined to your namespace. It cannot read or touch anything belonging to another customer, even knowing their contentId.

Lose a token, create another — in the same account

Tokens are shown once and only their fingerprint is stored, so they cannot be recovered. A fresh token on the same account still sees every key you issued before: keys belong to the namespace, not to the credential.