> ## Documentation Index
> Fetch the complete documentation index at: https://red5.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Protect Streams with DRM Encryption in Red5 Pro

> Encrypt live streams with DRM using Red5 Pro and castLabs DRMtoday. Supports Widevine, PlayReady, and FairPlay for browser and device playback.

Digital Rights Management (DRM) lets you encrypt a live stream so that only viewers you authorize can play it back. Red5 Pro integrates with castLabs' DRMtoday platform to apply multi-DRM protection at the stream level, enabling you to monetize premium content, enforce subscription access, and comply with content licensing requirements.

## What DRM does

Without DRM, any viewer who obtains a stream URL can play it. DRM solves this by encrypting the media before it leaves your server and requiring each viewer's device to obtain a license key before decryption is allowed. The device contacts a license server, proves the viewer is authorized, and — only then — receives the key to decrypt playback.

<CardGroup cols={3}>
  <Card title="Premium content protection" icon="lock">
    Prevent unauthorized redistribution of pay-per-view events, premium courses, or licensed broadcasts.
  </Card>

  <Card title="Subscription-gated streams" icon="id-card">
    Restrict live stream access to authenticated subscribers and revoke access immediately when a subscription lapses.
  </Card>

  <Card title="Live event monetization" icon="ticket">
    Charge per-event access with confidence that viewers cannot share or re-stream your content without authorization.
  </Card>
</CardGroup>

## DRM systems supported via castLabs

Red5 Pro's DRM integration uses castLabs DRMtoday, which provides a single multi-DRM backend covering all major DRM systems:

| DRM system    | Primary use case                       |
| ------------- | -------------------------------------- |
| **Widevine**  | Chrome, Firefox, Android, Chromecast   |
| **PlayReady** | Edge, Internet Explorer, Windows, Xbox |
| **FairPlay**  | Safari on macOS and iOS, Apple TV      |

By using a single integration point, you avoid maintaining separate license servers for each DRM system. castLabs handles license delivery across all platforms.

## How DRM works with Red5 Pro

DRM protection is applied at the WebRTC stream level using the [Insertable Streams API](https://developer.mozilla.org/en-US/docs/Web/API/Insertable_Streams_for_MediaStreamTrack_API), which allows media frames to be transformed in the browser before encoding or after decoding.

<Steps>
  <Step title="Publisher encrypts the outgoing stream">
    On the publisher side, the Red5 Pro WebRTC SDK applies a castLabs `encrypt-worker` transform to each video and audio frame before it is sent. The transform uses merchant keys provided by your DRMtoday account to encrypt the content.
  </Step>

  <Step title="Encrypted stream travels through Red5 Pro">
    The encrypted frames pass through your Red5 Pro Origin and Edge nodes like any other WebRTC stream. The server does not need to decrypt or re-encrypt the content — encryption is end-to-end at the frame level.
  </Step>

  <Step title="Subscriber obtains a DRM license">
    When an authorized viewer connects, the Red5 Pro WebRTC SDK uses the castLabs `rtc-drm-transform` library to request a license from the DRMtoday license server. The license server validates the viewer's credentials and returns the decryption key.
  </Step>

  <Step title="Subscriber decrypts playback">
    The `videoTransformFunction` and `audioTransformFunction` transforms from the castLabs library are applied to incoming frames, decrypting them before they reach the video element for playback.
  </Step>
</Steps>

## Prerequisites

Before you can use DRM with Red5 Pro, you need:

* **A castLabs DRMtoday account.** You must have an environment and merchant account configured in DRMtoday. Contact [castLabs](https://castlabs.com) to set this up.
* **A licensed Red5 Pro deployment.** DRM is available to Red5 Pro licensed customers.
* **A browser that supports Insertable Streams.** Chromium-based browsers (Chrome, Edge) have the most complete support. Check the [MDN compatibility table](https://developer.mozilla.org/en-US/docs/Web/API/Insertable_Streams_for_MediaStreamTrack_API) before targeting other browsers.
* **The castLabs SDK files.** You will need `encrypt-worker.js` for the publisher and `rtc-drm-transform.min.js` for the subscriber.

<Warning>
  DRM requires a browser that supports the Insertable Streams API. Test your target browsers before deploying to production. Some polyfills are available, but full support is not guaranteed outside Chromium-based browsers.
</Warning>

## Configuration overview

Both the publisher and subscriber integrations require a set of DRMtoday-specific values. Your castLabs merchant account provides these.

| Parameter                        | Description                                                                                      |
| -------------------------------- | ------------------------------------------------------------------------------------------------ |
| `environment`                    | The DRMtoday environment where your encrypted stream resides (e.g., staging or production).      |
| `merchant`                       | Your merchant account identifier within DRMtoday.                                                |
| `encryption` / `encryption mode` | The AES encryption mode used on the stream (e.g., `cbcs` for CBCS/FairPlay-compatible).          |
| `keyId`                          | The key identifier used in encryption and decryption. Provided by the merchant in base64 format. |
| `iv`                             | The initialization vector for the encryption cipher. Provided by the merchant in base64 format.  |

## Code reference

### Publishing an encrypted stream

The publisher uses the castLabs `encrypt-worker.js` alongside the Red5 Pro WebRTC SDK. The worker is applied as a transform during stream initialization.

```javascript publisher.js theme={null}
import { WHIPClient } from '@red5pro/sdk';

// Initialize the WHIP publisher with the encryption worker
const publisher = await new WHIPClient().init(config, {
  worker: new Worker('./encrypt-worker.js'),
});

await publisher.publish();
```

### Subscribing to an encrypted stream

The subscriber imports the castLabs `rtc-drm-transform` library and provides the transform functions to a `WHEPClient`. After the subscribe session starts, you call `setDrm` to pass the DRM configuration and video element to the library.

```javascript subscriber.js theme={null}
import {
  setDrm,
  videoTransformFunction,
  audioTransformFunction,
  Environments,
} from './lib/castlabs/rtc-drm-transform/rtc-drm-transform.min.js';
import { WHEPClient } from '@red5pro/sdk';

const transforms = {
  video: videoTransformFunction,
  audio: audioTransformFunction,
  worker: worker,
};

// Initialize and start the subscriber with DRM transforms
const subscriber = await new WHEPClient().init(config, transforms);
await subscriber.subscribe();

// Apply DRM configuration to the video element
const element = document.querySelector('#video-player');

const drmConfig = {
  environment: Environments.Staging,
  merchant: 'your-merchant-id',
  audioEncrypted: false,
  encryption: 'cbcs',
  keyId: 'base64-encoded-key-id',
  iv: 'base64-encoded-iv',
};

setDrm(element, drmConfig);
```

<Tip>
  Set `audioEncrypted: false` if you are encrypting video only. Encrypting audio independently is supported but requires separate key material from your DRMtoday merchant configuration.
</Tip>

## Getting the full DRM integration guide

The complete DRM integration guide — including castLabs library setup, DRMtoday account configuration, and advanced encryption scenarios — is available to licensed Red5 Pro customers through the Red5 Pro support portal.

<Note>
  Access the full DRM integration documentation and request implementation support at the [Red5 Pro Support Portal](https://customer.support.red5.net/servicedesk/customer/portals). You will need to log in with your licensed customer account.
</Note>