Configure DRM encryption for videos and playback - ApsaraVideo VOD

Apply DRM (Digital Rights Management) encryption to videos in ApsaraVideo VOD and play them back using ApsaraVideo Player SDK.

Limitations

You can enable DRM encryption only in the ApsaraVideo VOD console.

Billing

DRM encryption uses the pay-as-you-go billing method with no minimum fees. Charges consist of two parts:

Charge type	When charged
Transcoding fee	When a video is transcoded with DRM encryption enabled.
License fee	Each time a device requests a license to play a DRM-encrypted video.

For pricing details, see DRM encryption.

DRM encryption compatibility

DRM solution	Mobile devices	Browsers
Widevine	Android	Chrome, Firefox 47 and later, Microsoft Edge, and Opera
FairPlay	iOS	Safari

Note

Before you use DRM encryption, review the rules and limits of Widevine and FairPlay.

Apply DRM encryption

Step 1: (Optional) Apply and upload DRM certificate

Note

To protect content for iOS devices with FairPlay, you must apply for and upload a FairPlay certificate. You can skip this step if you only need to protect content for Android devices by using Widevine.

Apply for a FairPlay certificate.
For more information, see Apply for a FairPlay Streaming certificate.

Upload the FairPlay certificate.

Log on to the ApsaraVideo VOD console.
In the left-side navigation pane, choose Configuration Management > Media Processing > DRM Certificates.

Click Upload Certificate.

Parameter	Description
Certificate Name	A name for the certificate, 2 to 32 characters in length.
Content	The FairPlay certificate file. Only files with the .cer extension are supported.
Private Key	The password-protected private key that you created when applying for the certificate.
Passphrase	The key used to decrypt the private key. It must be 1 to 32 characters long and can contain letters and digits.
ASk	The Application Secret Key (ASk) from Apple. It must be 1 to 32 characters long and can contain letters and digits.

Click OK.

Step 2: Create a DRM transcoding template group

Log on to the ApsaraVideo VOD console. In the left-side navigation pane, choose Configuration Management > Media Processing > Transcoding Template Groups.
On the Transcoding Template Groups page, click Create Transcoding Template Group to create a DRM-enabled transcoding template group.
You can enable DRM encryption in both regular transcoding templates and video packaging templates. The following steps show how to enable DRM encryption in a regular transcoding template:
- In the Basic information section, set Encapsulation Format to HLS.
- In the Advanced Parameters section, enable Video Encryption and select DRM Encryption.
- Configure other parameters as needed. For detailed parameter descriptions, see Transcoding templates.
Click Save.
Save this ID. You need it to start a DRM encryption job.

Step 3: (Optional) Create a workflow for DRM transcoding

A workflow orchestrates media processing tasks such as transcoding, content review, and snapshotting in a specific order. When triggered during media upload or processing, the workflow automatically processes the media file according to the predefined steps.

You can add a transcoding node that uses your DRM-enabled transcoding template group to a workflow. You can create workflows only in the ApsaraVideo VOD console. For more information, see Workflows.

Step 4: Start a DRM transcoding job

Transcoding can be triggered both during and after a video upload. You can start a job by using a transcoding template group directly or by using a workflow that includes a transcoding node.

Currently, DRM-encrypted transcoding can only be triggered by using a transcoding template group and a workflow during video upload, or by using a workflow after video upload. Using a transcoding template group to trigger DRM-encrypted transcoding after a video is uploaded is not supported. For detailed instructions, see Audio and video transcoding for the console method and Audio and video transcoding for the OpenAPI method.

Step 5: Check the job result

Receive event notifications

If event notifications are configured for ApsaraVideo VOD, task information is sent in the SingleStreamTranscodeComplete or TranscodeComplete callback messages. For more information about how to configure event notifications, see Event Notification.

Query the job status

Use the console

Log on to the ApsaraVideo VOD console. In the left-side navigation pane, choose Media Files > Audio/Video.
On the Audio/Video page, check the Status of the target video.
If the Status is Normal, the DRM encryption and transcoding job was successful.
Click Manage in the row of the video.
Click the Video URL tab. ApsaraVideo VOD marks successfully encrypted streams with DRM Encryption.

Use the API

Call the GetPlayInfo operation and set the ResultType parameter to Multiple to retrieve all transcoded streams for the video. The EncryptType parameter in the response indicates the encryption type of each stream.

Play a DRM-encrypted video

DRM-encrypted videos can be played only by using ApsaraVideo Player SDK.

ApsaraVideo Player SDK supports multiple platforms, including iOS, Android, and web (HTML5 and Flash). Integrate the SDK into your applications or websites to enable playback of DRM-encrypted videos.

When using ApsaraVideo Player SDK to play DRM-encrypted videos, note the following:

ApsaraVideo Player SDK 5.2.1 or later is required. FairPlay is supported on iOS, and Widevine is supported on Android.
A player license is required before you use ApsaraVideo Player SDK. For more information, see Obtain a license.
Before integrating ApsaraVideo Player SDK, review the DRM compatibility for each platform. For more information, see Compatibility of ApsaraVideo Player SDK.
For instructions on playing DRM-encrypted videos, see the playback guide for your target platform: Play an encrypted video, Play an encrypted video, and Play an encrypted video.
Operations such as rotate, mirror, and screenshot are not supported during playback of DRM-encrypted videos.

ApsaraVideo VOD:Configure DRM encryption