Some MPEG-DASH (.mpd) sources are encrypted with DRM, such as Widevine, PlayReady or generic CENC. If you hold valid decryption keys for a stream, the DRM keys option lets your servers decrypt it and serve it like any other channel.

Legal notice: this feature is NOT designed to crack, pirate, bypass or circumvent DRM protection in any way. The system cannot break encryption or generate keys on its own. It only processes encrypted content if and only if you supply valid decryption keys that you obtained through legitimate and legal means. Xtream AI does not provide any keys, tools or methods to obtain them.

How it works

When an MPEG-DASH stream is protected, its audio and video are encrypted. With the correct keys, your servers decrypt the input in real time and then process it (restream or transcode) as if it were an open stream.

Set up DRM keys on a channel

  1. Go to Channels → Add Stream, or open an existing channel.
  2. In DRM Keys Options, turn on Stream requires DRM keys.
  3. In Key input method, choose Manual (KID / KEY) or By URL.
  4. Enter the keys (see below).
  5. Save the channel.

If the keys are correct, the channel starts like any other channel.

DRM keys cannot be used together with Direct Source. When Direct Source is on, the DRM option is turned off.

Manual (KID / KEY)

Use this when the keys are fixed and do not change.

  • KID (Key ID): the identifier of the key, a hexadecimal string, for example d1926639a022b7c62b50424683050186.
  • KEY: the secret decryption key for that KID, also hexadecimal, for example e6b9075775347209520a068016ddcc68.

A stream can use different keys for video and audio. Type in the last row and a new empty row appears for the next pair.

By URL

Use this when the keys rotate, or when you manage them from one place. Enter a DRM Keys URL (for example https://keys.example.com/keys.json). The server reads this URL when the stream starts.

The URL must return a JSON array of objects, each with a kid and a key:

[
  {
    "kid": "d1926639a022b7c62b50424683050186",
    "key": "e6b9075775347209520a068016ddcc68"
  },
  {
    "kid": "82046274092472947294724928424294",
    "key": "c7382748274827428748274827482748"
  }
]

When you switch to By URL, the manual KID / KEY rows are cleared. Only one method is used.

KID and KEY in short

  • KID is like the number of a lock. It tells the decryptor which key it needs. It is public and appears in the stream manifest.
  • KEY is the key itself. It is secret, and it is the part that must be obtained legally and kept safe.

Startup time

DRM streams work with On Demand and Turbo On Demand. Turbo On Demand keeps a pre-buffered connection, so channels usually start faster. See On demand vs Turbo on demand.