> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://mediakind.ferndocs.com/mkio/how-to/drm-content-protection/clearkey-encryption/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://mediakind.ferndocs.com/_mcp/server.

# ClearKey Encryption

ClearKey provides basic content encryption with the lowest possible latency for media encryption and decryption. It works with both HLS and DASH playback. ClearKey does not use a full DRM license server, making it simpler to set up than Widevine, PlayReady, or FairPlay.

## Prerequisites

* A running streaming endpoint.

* An asset verified to play without encryption using `Predefined_ClearStreamingOnly`.

## ClearKey without token restriction

Use this configuration when you want basic encryption without requiring a JWT token for license acquisition. This is useful for testing or low-security scenarios.

### Create the content key policy

* Navigate to Content Key Policies and select Create Content Key Policy.

* Enter a descriptive name (for example, `clearkey-open`).

* Select Add next to the Clear Key section.

* Enter a policy option name.

* Under Use token restriction, select No.

* Select Add, then Create.

### Create a streaming locator

* Navigate to your asset and select Add streaming locator.

* Enter a name for the locator.

* Set Streaming policy to `Predefined_ClearKey`.

* Set Content key policy to the ClearKey policy you created.

* Select Add.

### Get the playback URLs

Select the streaming locator you created, choose a running streaming endpoint, and select **Apply**. MK.IO generates HLS and DASH playback URLs.

### Test playback

* Navigate to the MKPlayer page.

* Select HLS as the protocol and ClearKey as the DRM.

* Paste the HLS playback URL.

* Select Play.

For DASH playback, select **DASH** as the protocol and provide the ClearKey license acquisition URL: this URL is displayed at the bottom of the asset streaming locator page.

## ClearKey with JWT token restriction

Add a JWT token requirement to ClearKey encryption for an additional layer of access control.

### Create the content key policy

* Navigate to Content Key Policies and select Create Content Key Policy.

* Enter a descriptive name (for example, `clearkey-jwt`).

* Select Add next to the Clear Key section.

* Enter a policy option name.

* Under Use token restriction, select Yes.

* Configure the token fields:

Token type: `JWT`

* Issuer: a string of your choice (for example, your company name).

* Audience: a string of your choice (for example, your audience identifier).

* Primary verification key: a Base64-encoded string. You can generate this by encoding a passphrase at a site such as `base64encode.org`. For example, encoding `mycompanyaudience` produces `bXljb21wYW55YXVkaWVuY2U=`.

* Select Add, then Create.

### Create a streaming locator

* Navigate to your asset and select Add streaming locator.

* Enter a name for the locator.

* Set Streaming policy to `Predefined_ClearKey`.

* Set Content key policy to the ClearKey JWT policy you created.

* Select Add, then select the locator and select Apply.

The player page may show a `DRM_FAILED_LICENSE_REQUEST` error. This is expected because the encrypted stream requires a JWT token that has not been provided yet.

### Generate a JWT token

Follow the [JWT token authentication guide](/mkio/how-to/drm-content-protection/jwt-token-authentication) to generate a token using the same issuer, audience, and primary verification key you configured in the content key policy.

### Test playback

* Navigate to the MKPlayer page.

* Select your protocol (HLS or DASH) and ClearKey as the DRM.

* Paste the playback URL in Source URL.

* For HLS: the license URL is auto-populated (`HLS_AES`). For DASH: paste the ClearKey license acquisition URL.

* In the License request headers field, enter the authorization header with your JWT token:

```json
{"Authorization": "Bearer <your-jwt-token>"}

```

Select Play.