Get started

DRM-protected video is encrypted. To watch it, the player has to ask a server for a license, and that server decides whether to grant one and under what conditions. Airi is those two pieces: it issues the encryption keys and runs the license server.

You bring the video and the encryption step. We bring everything else: the keys, the negotiation with each DRM system, and the playback rules you define.

The whole round trip

1. You ask for a key. We return a keyId (public) and a key (secret).
2. You encrypt the video with that key using your packager — Shaka Packager, Bento4, MediaConvert, whatever you already run.
3. You publish the manifest pointing at our license server.
4. A viewer hits play. Their player asks for a license, and we decide whether to grant it according to your rules.

There are two ways to use Airi, and you can mix them: through the dashboard, or through the API.

From the dashboard

1. Create your account at airi.live. All you need is an email — we send a code, no passwords.
2. Top up your balance. Without balance, keys cannot be created.
3. Hit Protect a title. You pick the qualities and the security level in plain language, and we hand you the keys.

From the API

Under Developers you create a credential. The token is shown once, so store it right away.

curl -X POST https://kms.airi.live/v1/keys \
  -H "Authorization: Bearer kms_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "contentId": "movie-1234",
    "drmSystems": ["widevine", "playready", "fairplay"],
    "track": "HD"
  }'

{
  "success": true,
  "created": true,
  "contentId": "movie-1234",
  "keyId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "key": "y3Jl...",      // secret: never publish it
  "iv": "8f2a...",
  "track": "HD",
  "drmSystemsData": [ /* per-system pssh */ ]
}

With the keyId and key you can encrypt. Here is Shaka Packager; the idea carries over to any other packager.

packager \
  in=video-1080.mp4,stream=video,output=video-hd.mp4 \
  in=audio.mp4,stream=audio,output=audio.mp4 \
  --enable_raw_key_encryption \
  --keys label=HD:key_id=a1b2c3d4e5f67890abcdef1234567890:key=<key in hex> \
  --protection_scheme cbcs \
  --mpd_output movie.mpd \
  --hls_master_playlist_output movie.m3u8

About --protection_scheme: choosing between cenc and cbcs decides which devices can play your video, and it cannot be changed without re-encrypting. It is explained in DRM systems.

The last step is telling the player where to ask for a license. Each DRM system speaks its own protocol, so each gets its own URL. They come back in licenseUrls with every key you create — copy them from there and you never have to think about this:

player.configure({
  drm: {
    servers: {
      'com.widevine.alpha': 'https://drm.airi.live/v2/widevine',
      'com.microsoft.playready': 'https://drm.airi.live/v2/playready',
      'com.apple.fps': 'https://drm.airi.live/fairplay'
    }
  }
});

From then on every license request goes through your rules: we check the key is yours, apply the security level you set for that quality, and record the playback so you can see it in the dashboard.

• Concepts — what a contentId is, why there is one key per quality, and when you need rotation.
• DRM systems — how Widevine, PlayReady, FairPlay and WisePlay differ, and which ones you need.
• Encrypt your video — a ready-to-run script that does the whole path, in Node or Python.
• Players — configuring Shaka Player and Video.js, and what to look at when something will not play.
• API reference — every endpoint, with runnable examples.