Your packager asks for a key
Shaka Packager, GPAC, ffmpeg — anything that reads CPIX. The response carries KID, key and PSSH for every enabled system.
GET /v1/cpix?k=<content-id>Widevine, FairPlay and Clear Key served from infrastructure you control. Content keys sealed under a hardware vault, every licence metered and revocable, and nothing charged per licence — because it runs on your metal.
$ curl -X POST https://api.superdrm.com/v1/keys \ -H "Authorization: Bearer sdrm_live_…" \ -d '{"label":"launch-film","scheme":"cbcs"}' { "content_id": "194341ee…", "systems": ["widevine","fairplay","clearkey"], "cpix": "/v1/cpix?k=194341ee…" } # player posts its CDM challenge… ✓ licence issued · widevine · 93 ms · metered
Two halves, one meter: Key Protect issues and seals content keys; the License Service answers CDM challenges under policy you set per token, per tenant, per request.
One key per content id, shared by every DRM system. CPIX 2 output that is field-compatible with hosted keygenerators — most packagers migrate by changing one URL.
Widevine with your own signer, FairPlay built on Apple’s FPS SDK and verified against Apple’s test vectors — production credentials pending Apple — and Clear Key for tooling. PlayReady is on the roadmap and answers honestly until it is licensed.
Import keys you already hold — from a hosted vendor’s CPIX, your own KMS — and serve licences for them at zero cost, with per-request fallback to the old vendor while you migrate.
Content keys never rest in the clear: sealed under a KEK in a PKCS#11 HSM, a cloud KMS, or software for dev. Every sealed row records its KEK, so rotation is a re-seal job, not a schema change. And once a backend registers a hybrid X25519 + ML-KEM-768 key, the content keys it fetches never cross the network in the clear either — they arrive encapsulated to that key, so traffic recorded today cannot be opened by a quantum computer later.
One row per licence attempt — issued or refused — with security level, device hash and latency. A live event stream and console watch every grant; revoking a key or share kills playback at the next request.
TPM remote attestation as licence policy: keys are released only to machines that prove — cryptographically — they booted your exact OS image. Revoke a device and its playback dies mid-token.
Hardware DRM ends where the vendor’s silicon does. Attestation extends it to appliances and managed fleets: the same boot-chain root of trust that makes mobile hardware DRM real, built from measured boot and your licence policy.
The device’s TPM mints a restricted attestation key; one API call registers it. A quote from anything else verifies as exactly that — something else.
Each viewer release registers its measured-boot PCR values. A patched kernel, a swapped compositor, another OS — different measurements, no keys.
At session start the device returns a TPM-signed quote over a single-use challenge. The verifier is native code in the licence server — no shell-outs, refusals name every failed check.
policy: {attested: true} gates any system — Widevine to Clear Key. Device status is re-checked on every request, so revocation is immediate.
SuperDRM speaks the open standards your stack already uses — CPIX 2, CENC, EME — so packagers and players integrate without SDKs.
Shaka Packager, GPAC, ffmpeg — anything that reads CPIX. The response carries KID, key and PSSH for every enabled system.
GET /v1/cpix?k=<content-id>The key is sealed under your vault’s KEK the moment it exists. Policy — hardware-secure only, HDCP, rental windows, attested devices — lives in signed licence tokens your backend mints.
POST /v1/tokens · pol: {hw, hdcp, attested…}Standard EME: the CDM’s challenge goes to your tenant’s licence endpoint, policy is enforced, the grant is metered, the frame decodes.
POST /v1/<tenant>/license/widevine?lt=…The same code at every tier — what changes is where the key-encryption key lives and who can ever see it.
Ships as docker compose up, a Helm chart, or a single Node service + Postgres.
On-prem installs carry a signed install licence and report usage to your mothership — and every install
exports and re-imports its entire state with its keys intact.