Get content keys for your packager
This article is a part of the DRM Quick Start guide, DRM-only path.
Your packager encrypts each video with a content key. It gets that key from the Axinom DRM Key Service over one of the supported protocols, and the Key Service derives the key from the key seed of your environment. Later, the License Service reconstructs the same key from the key ID alone, which is why you never store the key yourself.
Pick the section that matches your packager.
Widevine Common Encryption (self-service)​
This JSON-based protocol is used by Shaka Packager and several other packagers, and it works for Widevine, PlayReady, and FairPlay keys alike. Requests are signed with credentials that you create yourself.
Create signing credentials​
In the Management System, go to Admin Settings / DRM Service and open Widevine Common Encryption API. Click Add Widevine Common Encryption API Credentials, enter a Provider Name of your choice, and click Proceed.
The Signing Key and Signing IV are generated for you when you save. Copy both with their copy buttons; the key stays masked on screen.
Try a request​
Open the Widevine Common Encryption Tool.
- Enter your Provider Name, Signing Key, and Signing IV.
- Pick a sample request and click Sign.
- Enter the CENC URL from your DRM Service page as the endpoint and click POST.
A successful response has "status": "OK" and returns, per track, a key_id, the key, and a PSSH box.
The Management System copies the signing key and IV in base64.
The tool currently expects both as hexadecimal strings.
Convert before pasting, for example on macOS or Linux: echo 'PASTE_BASE64' | base64 -d | xxd -p -c 256.
Your packager may accept either format; check its documentation.
Use it in your packager​
Point your packager at the same CENC URL with the same three values. Integration with Shaka Packager shows a complete command line.
SPEKE, Harmonic, Anevia, Broadpeak (management key required)​
These protocols authenticate with Basic authentication: your Key Service Tenant ID and a Key Service management key. The Tenant ID is on your DRM Service page under Additional Information.
A Mosaic environment is created without a management key, because Mosaic itself does not need one. Request one from Axinom Support before you continue. State the name of your environment and the protocol you use.
Once you have the key:
- Try a request with the SPEKE Tool, using your Tenant ID, the management key, and the Speke or Speke V2 URL from your DRM Service page.
- Configure your packager or the AWS side with the same URL and credentials. The encoder guides walk through the specifics: AWS MediaPackage and MediaLive, AWS MediaConvert, Harmonic, Anevia, Broadpeak.
The management key cannot be recovered if you lose it; Axinom stores only a hash. Store it in your secrets manager, not in job definitions or source code.
Keep the key ID​
Whatever the protocol, note the key ID of every video you protect. Your entitlement messages name key IDs, and that is how the License Service knows which key to issue. With some encoders the key ID is not obvious; see SPEKE keyId Override and SPEKE Key ID Extraction.