Support for DRM Keys

Xtream AI Streaming Panel includes native support for the processing and retransmission of DRM (Digital Rights Management) protected streams, such as Widevine, Playready, or generic CENC.

[!IMPORTANT] Legal Disclaimer: This functionality is NOT designed to "crack," pirate, bypass, or circumvent DRM protection in any way. Furthermore, the system DOES NOT have the technical capability to break encryption or generate keys on its own. Its sole purpose is to enable the processing and playback of encrypted content if and only if you possess the valid decryption credentials (Keys) obtained through legitimate and legal means. Xtream AI doesn't provide any keys, tools, or methods to obtain them illegally.

How does it work?

When an MPEG-DASH (.mpd) stream is protected, the audio and video content is encrypted. For FFmpeg to process it (transcode or simply restream), it requires the correct decryption keys.

Xtream AI utilizes internal tools to apply these keys to the input stream in real-time, allowing the panel to ingest the signal as if it were an open stream, provided the correct keys are supplied.

Input Methods

You can configure DRM keys in the stream editing tab, under the DRM Keys Options section. There are two methods to provide the keys:

1. Manual (KID / KEY)

This method is ideal when the keys are static and do not change over time.

  • KID (Key ID): This is the unique identifier for the key. It is typically a hexadecimal string (e.g., d1926639a022b7c62b50424683050186).
  • KEY: This is the secret decryption key corresponding to that ID. It is also a hexadecimal string (e.g., e6b9075775347209520a068016ddcc68).

You can add multiple KID/KEY pairs if the stream uses different keys for video, audio, etc. Use the + button (or type in the last row) to add more.

2. By URL (Automatic)

This method is recommended if the keys rotate periodically or if you prefer to manage them from a centralized external source.

You must provide a URL (e.g., https://myserver.com/keys.json) that returns a JSON with the current keys. Xtream AI will query this URL when starting the stream process.

Expected JSON Structure

The URL must return a JSON Array of Objects, where each object has kid and key properties.

[
  {
    "kid": "d1926639a022b7c62b50424683050186",
    "key": "e6b9075775347209520a068016ddcc68"
  },
  {
    "kid": "82046274092472947294724928424294",
    "key": "c7382748274827428748274827482748"
  }
]

[!NOTE] If a URL is configured, the manual input fields (KID/KEY) will be ignored. The system prioritizes the URL.

Difference between KID and KEY

  • KID (Key ID): Think of this as the "lock number." It tells the player (or decryptor) which specific key is needed to unlock the content. This ID is public and visible in the stream manifest.
  • KEY: This is the "physical key." It is the secret string that actually decrypts the data. This is the sensitive part that must be protected and obtained legally.

Panel Configuration

  1. Go to Streams -> Add Stream (or edit an existing one).
  2. In the options section, enable the switch Stream requires DRM keys.
  3. Select the method: Manual or By URL.
  4. Enter the corresponding data.
  5. Save the stream.

If the keys are correct and valid, the panel will be able to download, decrypt, and process the signal just like any other IPTV channel.

Performance Optimization

You can utilize On Demand or Turbo On Demand modes for DRM-protected streams.

Using Turbo On Demand with DRM streams is highly recommended, as it can reduce the startup time by up to 90%, providing a much smoother user experience compared to constantly running streams or standard on-demand modes.