Generating License URL

Licensing API is used to create temporary URLs that allow playback on a device. DRM enabled video players such as Exoplayer for Android or Shaka player for the web will have configuration option for providing license URL along with URL to your dash manifest. We recommended generating unique license URL for every playback.

This requires configuring your backend to allow either an XHR/Fetch API or generate this URL during page rendering. This is different from a typical video sharing site such as youtube where the embed code remains constant. A correct DRM setup must ensure that the logged-in user must be verified and the access checked when generating this URL.

Must not implement on Front-end

This API must not be implemented on a front-end such as within a mobile app or web app. Doing so will make the secret API key visible to the public and void any security measures.

Sample license API implemention

NODE

/**
 * PLACE THIS SNIPPET OUTSIDE THE REQUEST HANDLER
 */
const APIKEY = '_____________________________';

const crypto = require('crypto');
/**
 * @param {string|buffer} key secret in utf8
 * @param {string} input utf8 input
 * @return {string} Buffer
 */
const hmac = (key, input) => {
  const hm = crypto.createHmac('sha256', key);
  hm.update(input);
  return hm.digest();
};
/**
 * base64 a buffer into the url safe version
 * @param {buffer} input
 * @return {string}
 */
const urlSafeB64 = (input) => {
  return input.toString('base64').replace(/\//g, '_').replace(/\+/g, '-');
};

/**
 * INSIDE THE REQUEST HANDLER/CONTROLLER
 */
// obtain from database
const CONTENT_ID = '_________________';
const DRM_TYPE = '___'; // fps or wv
const timestamp = Math.floor(new Date().getTime() / 1000);
const contentAuthObj = {
  contentId: CONTENT_ID,
  expires: timestamp + 900,
};
const signingDate = new Date().toISOString().replace(/[-.:]/g, '');
const contentAuthStr = urlSafeB64(Buffer.from(JSON.stringify(contentAuthObj)));
const signedDate = hmac(APIKEY, signingDate);
const hash = urlSafeB64(hmac(signedDate, contentAuthStr));
const keyId = APIKEY.substr(0, 16);
const signature = `${keyId}:${signingDate}:${hash}`;
const LICENSE_URL =
  `https://license.vdocipher.com/auth/${DRM_TYPE}/` +
  urlSafeB64(
    Buffer.from(
      JSON.stringify({
        contentAuth: `${contentAuthStr}`,
        signature: `${signature}`,
      }),
    ),
  );
console.log(LICENSE_URL);

PHP

/**
 * PLACE THIS SNIPPET OUTSIDE THE REQUEST HANDLER
 */
const API_KEY = '_____________________________';
$keyId = substr(API_KEY, 0, 16);

function urlSafeBase64Encode($data) {
    $base64 = base64_encode($data);
    return strtr($base64, '+/', '-_');
}

/**
 * INSIDE THE REQUEST HANDLER/CONTROLLER
 */
// obtained from database
$contentId = '_________________';
$drm_type = '___' // fps or wv

$signingDate = date('Ymd\THis\Z');
$timestamp = time();
$contentAuthStr = urlSafeBase64Encode(json_encode([
    "contentId" => $contentId,
    "expires" => $timestamp + 900,
]));

$signedDate = hash_hmac('sha256', $signingDate, API_KEY, true);
$hash = urlSafeBase64Encode(hash_hmac('sha256', $contentAuthStr, $signedDate, true));

$signature = "$keyId:$signingDate:$hash";
$licenseUrl = "https://license.vdocipher.com/auth/$drm_type/" . urlSafeBase64Encode(json_encode([
    'contentAuth' => $contentAuthStr, 'signature' => $signature,
    ]));
echo $licenseUrl;

Adding advanced restrictions

License generated this way can still be copied by the end-user and shared. To ensure correct security, read the section on adding further restrictions to the license URL.

The next sections on adding further restrictions will modify the contentAuth object generated above. Everything else about signing and preparing the final URL will remain the same.