> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://mediakind.ferndocs.com/mkio/how-to/drm-content-protection/multi-drm-encryption/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://mediakind.ferndocs.com/_mcp/server.

# Multi-DRM Encryption

Multi-DRM encryption protects your streams with industry-standard DRM systems so that content plays securely across all major browsers and devices. MK.IO supports two multi-DRM configurations: full multi-DRM (Widevine + PlayReady + FairPlay) and CENC-only (Widevine + PlayReady).

## Prerequisites

* A running streaming endpoint.

* An asset verified to play without encryption using `Predefined_ClearStreamingOnly`.

* For FairPlay: an Apple FairPlay Streaming certificate, password, and application secret key.

## Choose your configuration

| Configuration  | Streaming policy                   | Required schemes                | Use when                                                                            |
| -------------- | ---------------------------------- | ------------------------------- | ----------------------------------------------------------------------------------- |
| Full multi-DRM | `Predefined_MultiDrmStreaming`     | Widevine + PlayReady + FairPlay | You need to support all platforms, including Safari and Apple devices.              |
| CENC multi-DRM | `Predefined_MultiDrmCencStreaming` | Widevine + PlayReady            | You do not need FairPlay support. Covers Chrome, Edge, Android, and most smart TVs. |

The streaming policy enforces which DRM schemes must be present in the content key policy. A `Predefined_MultiDrmStreaming` locator fails if the policy does not include all three schemes. A `Predefined_MultiDrmCencStreaming` locator fails if it does not include both Widevine and PlayReady.

## Full multi-DRM with JWT tokens

This example creates a content key policy with Widevine, PlayReady, and FairPlay, all protected by JWT token authentication.

### Create the content key policy

* Navigate to Content Key Policies and select Create Content Key Policy.

* Enter a name (for example, `multidrm-jwt`) and optional description.

* Select Add in the Digital Rights Management section.

### Add Widevine

* Select Add Widevine.

* Enter a policy option name.

* Under Use token restriction, select Yes.

* Configure the token fields:

Token type: `JWT`

* Issuer: your chosen issuer string.

* Audience: your chosen audience string.

* Primary verification key: your Base64-encoded key.

* Leave Widevine template as `{}` unless you need a custom template.

* Select Add.

### Add PlayReady

* Select Add PlayReady.

* Enter a policy option name.

* Under Use token restriction, select Yes.

* Enter the same issuer, audience, and primary verification key as Widevine.

* Leave the PlayReady-specific options at their defaults unless you need custom settings.

* Select Add.

### Add FairPlay

* Select Add FairPlay.

* Enter a policy option name.

* Under Use token restriction, select Yes.

* Enter the same issuer, audience, and primary verification key as the other schemes.

* Provide your Apple FairPlay certificate, password, and application secret key.

* Select Add.

### Create the policy

Select **Create**. The policy now includes all three DRM schemes with JWT protection.

### Generate a JWT token

Follow the [JWT token authentication guide](/mkio/how-to/drm-content-protection/jwt-token-authentication) to generate a token using the issuer, audience, and primary verification key you configured.

### Create a streaming locator

* Navigate to your asset and select Add streaming locator.

* Enter a name.

* Set Streaming policy to `Predefined_MultiDrmStreaming`.

* Set Content key policy to the multi-DRM policy you created.

* Select Add, then select the locator and select Apply.

MK.IO generates playback URLs and license acquisition URLs for each DRM system.

### Test playback

See [Test DRM playback](/mkio/how-to/drm-content-protection/test-drm-playback) for instructions on testing with MKPlayer.

## CENC multi-DRM without tokens

This example creates a content key policy with Widevine and PlayReady only, with no token restriction. Use this for scenarios where token-based authentication is handled elsewhere or is not required.

### Create the content key policy

* Navigate to Content Key Policies and select Create Content Key Policy.

* Enter a name (for example, `multidrm-cenc-open`) and optional description.

* Select Add in the Digital Rights Management section.

### Add Widevine

* Select Add Widevine.

* Enter a policy option name.

* Under Use token restriction, select No.

* Leave Widevine template as `{}`.

* Select Add.

### Add PlayReady

* Select Add PlayReady.

* Enter a policy option name.

* Under Use token restriction, select No.

* Leave PlayReady options at defaults.

* Select Add.

### Create the policy and streaming locator

* Select Create to save the policy.

* Navigate to your asset and select Add streaming locator.

* Set Streaming policy to `Predefined_MultiDrmCencStreaming`.

* Set Content key policy to the CENC policy you created.

* Select Add, then select the locator and select Apply.

### Test playback

* Navigate to the MKPlayer page.

* Select DASH as the protocol and Widevine as the DRM.

* Paste the DASH playback URL in Source URL.

* Paste the Widevine license acquisition URL in License URL.

* Select Play.