Multi DRM JWT Specifications

Notice

This document is a machine-translated draft and is currently undergoing review. Some content may be inaccurate or differ from the original Korean version. For the most precise information, refer to the Korean documentation.

Multi DRM is a service that integrates multiple standard DRM technologies to securely protect content across various device and browser environments.

Kollus VOD integrates with the global DRM solution DoveRunner to manage Widevine (Android/Chrome), FairPlay (iOS/Safari), and PlayReady (Windows/Edge) DRM under a single JWT authentication specification.

Feature Activation

Multi DRM is an add-on service that requires a separate contract and activation. To activate this feature, contact your Account Manager(biz@catenoid.net) or Technical Support(tech_support@catenoid.net).

JWT technical specifications

Encryption algorithm

Kollus VOD supports only the HMAC SHA-256 (HS256) algorithm.

Header: { "alg": "HS256", "typ": "JWT" }

Authentication keys

The following two keys are used when generating and calling a JWT.

security key

Description: A secret key used for JWT signing and verification. Take care to prevent external exposure.
Where to find: Kollus VOD console > [Service account] > [Custom key]

Security Key Change

To change the security key, contact Technical Support(tech_support@catenoid.net).

Custom key

Description: A value derived by encrypting the security key, used together with the security key for authentication (JWT).
Where to find: Kollus VOD console > [Service account] > [Custom key]
- The value may be updated when the browser is refreshed; copy and apply the latest value at the time of use.

JWT payload detailed specifications

When integrating Multi DRM, you must include a drm_policy object inside the mc array to pass license information for each environment (Widevine, FairPlay, PlayReady).

Required options example

{
  "cuid": "{END_USER_ID}",
  "expt": 1703980800,
  "mc": [{
    "mckey": "{MEDIA_CONTENT_KEY}",
    "drm_policy": {
      "kind": "inka",
      "streaming_type": "dash",
      "data": {
        "license_url": "https://license.pallycon.com/ri/licenseManager.do",
        "certificate_url": "https://license.pallycon.com/ri/fpsKeyManager.do?siteId={YOUR_SITE_ID}",
        "custom_header": {
          "key": "pallycon-customdata-v2",
          "value": "{BASE64_ENCODED_TOKEN}"
        }
      }
    }
  }]
}

Basic options

Option	Type	Description
`cuid`	`string`	User ID This is the reference value for concurrent playback prevention, bookmark, and resume (`nscreen`) settings. It is recommended to use alphanumeric characters. Using Korean characters or special characters may restrict searching the prevention log.
`expt`	`integer`	JWT expiration date and time (Unix timestamp) Maximum value: 1893455999 (2029-12-31) Even after expiration, content access may be permitted for up to 1 minute to account for server time discrepancies.
`mc`	`array`	Array containing information about the content to play

Content options (settings inside the mc array)

Option	Type	Description
`mckey`	`string`	Media content key
`drm_policy`	`object`	Multi DRM policy data

DRM_policy object

Option	Type	Description
`kind`	`string`	DRM solution type. Enter the fixed value `"inka"` (formerly INKA Entworks)
`streaming_type`	`string`	Streaming protocol type `hls`: FairPlay `dash`: All other environments
`data`	`object`	Data required for license authentication and issuance

Data sub-options

Option	Type	Required	Description
`license_url`	`string`	△	(Required when using Widevine or PlayReady) License server address
`certificate_url`	`string`	△	(Required when using FairPlay) FairPlay certificate address
`custom_header`	`object`	◯	Custom header to be passed when requesting a license
`custom_header.key`	`string`	◯	Header key name (fixed to `"pallycon-customdata-v2"`)
`custom_header.value`	`string`	◯	DoveRunner license token value (Base64 encoding required)

DRM detailed settings

PlayReady

Supported environments: Windows Edge, Windows Chrome (138 or later)

Caution

The browser's hardware acceleration option must be enabled. If the acceleration feature is disabled, a -57208 error will occur during the license issuance stage and playback will be blocked.

How to enable hardware acceleration
- Edge: Top-right menu (···) > [Settings] > [System and performance] > Enable [Use graphics acceleration when available] > Restart browser
- Chrome: Top-right menu (⋮) > [Settings] > [System] > Enable [Use graphics acceleration when available] > Restart browser

{
  "drm_policy": {
    "kind": "inka",
    "streaming_type": "dash",
    "data": {
      "license_url": "https://license.pallycon.com/ri/licenseManager.do",
      "custom_header": {
        "key": "pallycon-customdata-v2",
        "value": "eyJ0aW1lc3RhbXAi..."
      }
    }
  }
}

Widevine

Supported environments: Chromium-based browsers, Android

Caution

Screen capture prevention: Works correctly only when hardware acceleration is enabled in the browser.
CSS conflicts: If certain CSS effects are applied inside an iframe, playback may not function smoothly due to browser security policies.
Incognito mode: Due to Google's security policy, Widevine DRM playback may be restricted in Incognito mode.

{
  "drm_policy": {
    "kind": "inka",
    "streaming_type": "dash",
    "data": {
      "license_url": "https://license.pallycon.com/ri/licenseManager.do",
      "custom_header": {
        "key": "pallycon-customdata-v2",
        "value": "eyJ0aW1lc3RhbXAi..."
      }
    }
  }
}

FairPlay

Supported environments: Safari, iOS, iPadOS

Site ID

In FairPlay environments, the certificate_url setting is required. Enter the ID issued from the DoveRunner console in the siteId parameter within certificate_url.

{
  "drm_policy": {
    "kind": "inka",
    "streaming_type": "hls",
    "data": {
      "license_url": "https://license.pallycon.com/ri/licenseManager.do",
      "certificate_url": "https://license.pallycon.com/ri/fpsKeyManager.do?siteId=XXXX",
      "custom_header": {
        "key": "pallycon-customdata-v2",
        "value": "eyJ0aW1lc3RhbXAi..."
      }
    }
  }
}

DoveRunner license token generation

The value to enter in the custom_header.value parameter is prepared by generating JSON data in the DoveRunner format and then Base64-encoding the entire string.

Token data structure

{
  "timestamp": "2025-12-31T23:59:59Z",
  "site_id": "XXXX",
  "policy": "...",
  "cid": "content_id"
}

Parameter description

Option	Description
`timestamp`	Token generation time (must comply with ISO 8601 format)
`site_id`	Site ID issued from the DoveRunner service
`policy`	A string defining the license policy (playback validity period, play count, etc.)
`cid`	Kollus upload file key Where to find: Kollus VOD console > [Library] > Click content title > [Overview] tab

Learn More

For a Guide on configuring license token data, refer to the official documentation.

JWT technical specifications​

Encryption algorithm​

Authentication keys​

security key​

Custom key​

JWT payload detailed specifications​

Required options example​

Basic options​

Content options (settings inside the mc array)​

DRM_policy object​

Data sub-options​

DRM detailed settings​

PlayReady​

Widevine​

FairPlay​

DoveRunner license token generation​

Token data structure​

Parameter description​