Licensing checklist
SuperDRM's code path is complete for every system. What turns each system from staging into production is a partner agreement with the CDM owner. None of the three charges per licence; the per-licence fees hosted DRM vendors pass on are their own margin. On the hosted service we hold these agreements for you; on an on-premises install you hold your own, or we provision ours into your install as sealed partner credentials.
#1. Widevine (Google) — Chrome, Edge, Firefox, Android, Chromecast, most TVs
| Item | Detail |
|---|---|
| Programme | Widevine partner programme — Content Provider / Service Provider |
| Where | https://www.widevine.com/contact → "Become a partner" |
| Agreement | Widevine Master License Agreement. No licence fee, no per-licence fee. |
| You receive | A provider name and AES signing key + IV for the Widevine Cloud License Service, production host license.widevine.com, and (optionally) the on-premise License Server SDK |
| Requirements | A shipping service, a named security contact, the Widevine security questionnaire, robustness rules acknowledged for any client you ship |
| Typical turnaround | 2–6 weeks |
| Staging meanwhile | license.uat.widevine.com with the public widevine_test signer — already wired; Google's terms restrict UAT to testing |
| Go-live in SuperDRM | superdrm partner:set widevine:prod --config '{"provider":"<name>","signing_key":"<hex>","signing_iv":"<hex>","host":"https://license.widevine.com"}' then SUPERDRM_WIDEVINE_ENV=prod. Keys issued under UAT stay playable under UAT; re-package (or re-issue keys for) content that must move to prod. |
Policy defaults: SD track type with hw enforcement done by SuperDRM (refuses L3 when a tenant policy says hw:true); set wv_track: "HD" on a tenant to make Google itself require L1.
#2. FairPlay Streaming (Apple) — Safari, iOS, iPadOS, tvOS, visionOS
| Item | Detail |
|---|---|
| Programme | FairPlay Streaming (FPS) — content provider |
| Where | https://developer.apple.com/streaming/fps/ (Apple Developer Program account required) |
| Agreement | FPS licence agreement. No fee beyond the developer programme. |
| You receive | The FPS Server SDK (Key Security Module reference implementation and test vectors) and, against your CSRs, the certificate bundle and provisioning data |
| Requirements | A live streaming service that protects content, a security contact, the KSM must run "in a secure server environment" |
| Typical turnaround | 1–3 weeks |
| Go-live in SuperDRM | Build the KSM sidecar from the SDK, run it next to the api (or in an enclave), set SUPERDRM_FPS_KSM_URL, install the certificate with superdrm tenant:drm <slug> fairplay --mode shared --public '{"cert_b64":"…"}'. Step by step: FairPlay Streaming. |
#3. PlayReady (Microsoft) — Xbox, Windows UWP apps, some smart TVs
Browsers do not need it: Edge on Windows ships Widevine, and Shaka picks Widevine first.
| Item | Detail |
|---|---|
| Programme | PlayReady Server licensing (PlayReady Server SDK) |
| Where | https://www.microsoft.com/playready/licensing/ |
| Agreement | Server SDK licence — a one-time fee (confirm the current schedule with Microsoft) and no per-licence royalty for online services |
| Status in SuperDRM | PSSH/WRMHEADER generation is implemented (4.0 for cenc, 4.3 for cbcs) so packaged content is future-proof; the licence endpoint returns 501 until the SDK is licensed. Enable per tenant with superdrm tenant:drm <slug> playready --enabled 1 once the server is in place. |
| Recommendation | Defer. Revisit when a customer needs Xbox or TV apps. |
#4. Clear Key
No agreement: Clear Key is a W3C key system built into every browser. It is software-only and offers no capture protection, so SuperDRM refuses it whenever the policy says hw:true — a silent downgrade from capture-blanked to screenshotable is the worst failure mode for this product.
Updated September 2026