Protect Streams with DRM Encryption in Red5 Pro

Encrypt live streams with DRM using Red5 Pro and castLabs DRMtoday. Supports Widevine, PlayReady, and FairPlay for browser and device playback.

Digital Rights Management (DRM) lets you encrypt a live stream so that only viewers you authorize can play it back. Red5 Pro integrates with castLabs’ DRMtoday platform to apply multi-DRM protection at the stream level, enabling you to monetize premium content, enforce subscription access, and comply with content licensing requirements.

What DRM does

Without DRM, any viewer who obtains a stream URL can play it. DRM solves this by encrypting the media before it leaves your server and requiring each viewer’s device to obtain a license key before decryption is allowed. The device contacts a license server, proves the viewer is authorized, and — only then — receives the key to decrypt playback.

Premium content protection

Prevent unauthorized redistribution of pay-per-view events, premium courses, or licensed broadcasts.

Subscription-gated streams

Restrict live stream access to authenticated subscribers and revoke access immediately when a subscription lapses.

Live event monetization

Charge per-event access with confidence that viewers cannot share or re-stream your content without authorization.

DRM systems supported via castLabs

Red5 Pro’s DRM integration uses castLabs DRMtoday, which provides a single multi-DRM backend covering all major DRM systems:

DRM system	Primary use case
Widevine	Chrome, Firefox, Android, Chromecast
PlayReady	Edge, Internet Explorer, Windows, Xbox
FairPlay	Safari on macOS and iOS, Apple TV

By using a single integration point, you avoid maintaining separate license servers for each DRM system. castLabs handles license delivery across all platforms.

How DRM works with Red5 Pro

DRM protection is applied at the WebRTC stream level using the Insertable Streams API, which allows media frames to be transformed in the browser before encoding or after decoding.

1. Publisher encrypts the outgoing stream

   On the publisher side, the Red5 Pro WebRTC SDK applies a castLabs encrypt-worker transform to each video and audio frame before it is sent. The transform uses merchant keys provided by your DRMtoday account to encrypt the content.

2. Encrypted stream travels through Red5 Pro

   The encrypted frames pass through your Red5 Pro Origin and Edge nodes like any other WebRTC stream. The server does not need to decrypt or re-encrypt the content — encryption is end-to-end at the frame level.

3. Subscriber obtains a DRM license

   When an authorized viewer connects, the Red5 Pro WebRTC SDK uses the castLabs rtc-drm-transform library to request a license from the DRMtoday license server. The license server validates the viewer’s credentials and returns the decryption key.

4. Subscriber decrypts playback

   The videoTransformFunction and audioTransformFunction transforms from the castLabs library are applied to incoming frames, decrypting them before they reach the video element for playback.

Prerequisites

Before you can use DRM with Red5 Pro, you need:

• A castLabs DRMtoday account. You must have an environment and merchant account configured in DRMtoday. Contact castLabs to set this up.
• A licensed Red5 Pro deployment. DRM is available to Red5 Pro licensed customers.
• A browser that supports Insertable Streams. Chromium-based browsers (Chrome, Edge) have the most complete support. Check the MDN compatibility table before targeting other browsers.
• The castLabs SDK files. You will need encrypt-worker.js for the publisher and rtc-drm-transform.min.js for the subscriber.

DRM requires a browser that supports the Insertable Streams API. Test your target browsers before deploying to production. Some polyfills are available, but full support is not guaranteed outside Chromium-based browsers.

Configuration overview

Both the publisher and subscriber integrations require a set of DRMtoday-specific values. Your castLabs merchant account provides these.

Parameter	Description
environment	The DRMtoday environment where your encrypted stream resides (e.g., staging or production).
merchant	Your merchant account identifier within DRMtoday.
encryption / encryption mode	The AES encryption mode used on the stream (e.g., cbcs for CBCS/FairPlay-compatible).
keyId	The key identifier used in encryption and decryption. Provided by the merchant in base64 format.
iv	The initialization vector for the encryption cipher. Provided by the merchant in base64 format.

Code reference

Publishing an encrypted stream

The publisher uses the castLabs encrypt-worker.js alongside the Red5 Pro WebRTC SDK. The worker is applied as a transform during stream initialization.

publisher.js

import { WHIPClient } from '@red5pro/sdk';

// Initialize the WHIP publisher with the encryption worker
const publisher = await new WHIPClient().init(config, {
  worker: new Worker('./encrypt-worker.js'),
});

await publisher.publish();

Subscribing to an encrypted stream

The subscriber imports the castLabs rtc-drm-transform library and provides the transform functions to a WHEPClient. After the subscribe session starts, you call setDrm to pass the DRM configuration and video element to the library.

subscriber.js

import {
  setDrm,
  videoTransformFunction,
  audioTransformFunction,
  Environments,
} from './lib/castlabs/rtc-drm-transform/rtc-drm-transform.min.js';
import { WHEPClient } from '@red5pro/sdk';

const transforms = {
  video: videoTransformFunction,
  audio: audioTransformFunction,
  worker: worker,
};

// Initialize and start the subscriber with DRM transforms
const subscriber = await new WHEPClient().init(config, transforms);
await subscriber.subscribe();

// Apply DRM configuration to the video element
const element = document.querySelector('#video-player');

const drmConfig = {
  environment: Environments.Staging,
  merchant: 'your-merchant-id',
  audioEncrypted: false,
  encryption: 'cbcs',
  keyId: 'base64-encoded-key-id',
  iv: 'base64-encoded-iv',
};

setDrm(element, drmConfig);

Set audioEncrypted: false if you are encrypting video only. Encrypting audio independently is supported but requires separate key material from your DRMtoday merchant configuration.

Getting the full DRM integration guide

The complete DRM integration guide — including castLabs library setup, DRMtoday account configuration, and advanced encryption scenarios — is available to licensed Red5 Pro customers through the Red5 Pro support portal.

Access the full DRM integration documentation and request implementation support at the Red5 Pro Support Portal. You will need to log in with your licensed customer account.