Operator CLI

bin/superdrm wraps the admin API. It reads SUPERDRM_URL and SUPERDRM_ADMIN_TOKEN from the environment, falling back to ~/.config/superdrm/api.env, so on the api host it needs no arguments. Under Compose, run it inside the api container or point SUPERDRM_URL at the published api address.

superdrm health
superdrm tenant:list
superdrm tenant:create <slug> <name> [--plan internal|developer|growth|scale|enterprise] [--webhook URL]
superdrm tenant:update <slug> [--plan X] [--status active|suspended] [--webhook URL|""] [--settings '{json}']
superdrm tenant:drm <slug> <widevine|fairplay|playready|clearkey> [--enabled 1|0] [--mode shared|own] [--config '{json}'] [--public '{json}']
superdrm tenant:rotate-secret <slug>
superdrm key:create <slug> [--name NAME] [--scopes a,b] [--env live|test]
superdrm key:revoke <slug> <key id>
superdrm partner:set <widevine:prod|widevine:uat|fairplay:prod> --config '{json}' [--public '{json}']
superdrm partner:list
superdrm usage [--tenant slug] [--from YYYY-MM-DD] [--to YYYY-MM-DD]
superdrm licences [--limit N]
superdrm audit [--limit N]
superdrm export <file.json.gz>
superdrm import <file.json.gz>
superdrm verify-kek [content id]
superdrm install:sign …          # mothership only: mint an install licence for an on-prem customer

#Common tasks

Onboard a tenant and hand over credentials

Shell

superdrm tenant:create acme "Acme Corp" --plan growth
# → api_key and token_secret, shown once

Install production Widevine credentials (after the partner agreement)

Shell

superdrm partner:set widevine:prod \
  --public '{"provider":"acme","host":"https://license.widevine.com"}' \
  --config '{"provider":"acme","signing_key":"<64 hex>","signing_iv":"<32 hex>","host":"https://license.widevine.com"}'
# then SUPERDRM_WIDEVINE_ENV=prod in the api env and restart

Install a tenant's FairPlay certificate

Shell

superdrm tenant:drm acme fairplay --mode shared --public '{"cert_b64":"<base64 of fps_certificate.bin>"}'

Turn PlayReady on for a tenant (once the server is licensed)

Shell

superdrm tenant:drm acme playready --enabled 1

Set a tenant default policy (hardware required, HDCP type 0)

Shell

superdrm tenant:update acme --settings '{"policy":{"hw":true,"hdcp":"type0"}}'

Suspend and reinstate

Shell

superdrm tenant:update acme --status suspended     # the licence path re-reads status per request
superdrm tenant:update acme --status active

Watch the meter

Shell

superdrm licences --limit 20
superdrm usage --tenant acme --from 2026-09-01

Move to another host

Shell

superdrm export superdrm-$(date +%F).json.gz
DATABASE_URL=postgres://… superdrm import superdrm-2026-09-16.json.gz
superdrm verify-kek

Every command prints the API's JSON reply; a non-2xx exits 1 with the error body.

Updated September 2026