Multi-DRM JWT Specifications

Notice

This document is a machine-translated draft and is currently undergoing review. Some content may be inaccurate or differ from the original Korean version. For the most precise information, refer to the Korean documentation.

Multi-DRM is a service that integrates multiple standard DRM technologies to securely protect content across various device and browser environments.

Kollus VOD integrates with the global DRM solution DoveRunner to manage Widevine (Android/Chrome), FairPlay (iOS/Safari), and PlayReady (Windows/Edge) DRM under a single JWT authentication specification.

Feature activation

Multi-DRM is an add-on service that requires a separate contract and activation. To activate this feature, contact Technical Support (tech_support@kollus.com) or Account Manager.

JWT technical specifications

Encryption algorithm

Kollus VOD supports only the HMAC SHA-256 (HS256) algorithm.

Header: { "alg": "HS256", "typ": "JWT" }

Authentication keys

The following two keys are used when generating and calling a JWT.

Security key

Description: A secret key used for JWT signing and verification. Take care to prevent external exposure.
Where to find: Kollus VOD console > [Settings] > [Custom key]
Changing the security key: Contact Technical Support (tech_support@kollus.com).

Custom key

Description: A value derived by encrypting the security key, used together with the security key for authentication (JWT).
Where to find: Kollus VOD console > [Settings] > [Custom key]
- The value may be updated when the browser is refreshed; copy and apply the latest value at the time of use.

JWT payload detailed specifications

When integrating Multi-DRM, you must include a drm_policy object inside the mc array to pass license information for each environment (Widevine, FairPlay, PlayReady). For key information, refer to the Authentication & Keys document.

Required options example

{
  "cuid": "{END_USER_ID}",
  "expt": 1703980800,
  "mc": [{
    "mckey": "{MEDIA_CONTENT_KEY}",
    "drm_policy": {
      "kind": "inka",
      "streaming_type": "dash",
      "data": {
        "license_url": "https://license.pallycon.com/ri/licenseManager.do",
        "certificate_url": "https://license.pallycon.com/ri/fpsKeyManager.do?siteId={YOUR_SITE_ID}",
        "custom_header": {
          "key": "pallycon-customdata-v2",
          "value": "{BASE64_ENCODED_TOKEN}"
        }
      }
    }
  }]
}

Basic options

Option	Type	Description
`cuid`	`string`	User ID This is the reference value for concurrent playback prevention, bookmark, and resume (`nscreen`) settings. It is recommended to use alphanumeric characters. Using Korean characters or special characters may restrict searching the prevention log.
`expt`	`integer`	JWT expiration date and time (Unix timestamp) Maximum value: 1893455999 (2029-12-31) Even after expiration, content access may be permitted for up to 1 minute to account for server time discrepancies.
`mc`	`array`	Array containing information about the content to play

Content options (settings inside the mc array)

Option	Type	Description
`mckey`	`string`	Media content key
`drm_policy`	`object`	Multi-DRM policy data

DRM_policy object

Option	Type	Description
`kind`	`string`	DRM solution type. Enter the fixed value `"inka"` (formerly INKA Entworks)
`streaming_type`	`string`	Streaming protocol type `hls`: FairPlay `dash`: All other environments
`data`	`object`	Data required for license authentication and issuance

Data sub-options

Option	Type	Required	Description
`license_url`	`string`	△	(Required when using Widevine or PlayReady) License server address
`certificate_url`	`string`	△	(Required when using FairPlay) FairPlay certificate address
`custom_header`	`object`	◯	Custom header to be passed when requesting a license
`custom_header.key`	`string`	◯	Header key name (fixed to `"pallycon-customdata-v2"`)
`custom_header.value`	`string`	◯	DoveRunner license token value (Base64 encoding required)

DRM detailed settings

PlayReady

Supported environments: Windows Edge, Windows Chrome (138 or later)

Caution

The browser's hardware acceleration option must be enabled. If the acceleration feature is disabled, a -57208 error will occur during the license issuance stage and playback will be blocked.

How to enable hardware acceleration
- Edge: Top-right menu (···) > [Settings] > [System and performance] > Enable [Use graphics acceleration when available] > Restart browser
- Chrome: Top-right menu (⋮) > [Settings] > [System] > Enable [Use graphics acceleration when available] > Restart browser

{
  "drm_policy": {
    "kind": "inka",
    "streaming_type": "dash",
    "data": {
      "license_url": "https://license.pallycon.com/ri/licenseManager.do",
      "custom_header": {
        "key": "pallycon-customdata-v2",
        "value": "eyJ0aW1lc3RhbXAi..."
      }
    }
  }
}

Widevine

Supported environments: Chromium-based browsers, Android

Caution

Screen capture prevention: Works correctly only when hardware acceleration is enabled in the browser.
CSS conflicts: If certain CSS effects are applied inside an iframe, playback may not function smoothly due to browser security policies.
Incognito mode: Due to Google's security policy, Widevine DRM playback may be restricted in Incognito mode.

{
  "drm_policy": {
    "kind": "inka",
    "streaming_type": "dash",
    "data": {
      "license_url": "https://license.pallycon.com/ri/licenseManager.do",
      "custom_header": {
        "key": "pallycon-customdata-v2",
        "value": "eyJ0aW1lc3RhbXAi..."
      }
    }
  }
}

FairPlay

Supported environments: Safari, iOS, iPadOS

Site ID

In FairPlay environments, the certificate_url setting is required. Enter the ID issued from the DoveRunner console in the siteId parameter within certificate_url.

{
  "drm_policy": {
    "kind": "inka",
    "streaming_type": "hls",
    "data": {
      "license_url": "https://license.pallycon.com/ri/licenseManager.do",
      "certificate_url": "https://license.pallycon.com/ri/fpsKeyManager.do?siteId=XXXX",
      "custom_header": {
        "key": "pallycon-customdata-v2",
        "value": "eyJ0aW1lc3RhbXAi..."
      }
    }
  }
}

DoveRunner license token generation

The value to enter in the custom_header.value parameter is prepared by generating JSON data in the DoveRunner format and then Base64-encoding the entire string.

Token data structure

{
  "timestamp": "2025-12-31T23:59:59Z",
  "site_id": "XXXX",
  "policy": "...",
  "cid": "content_id"
}

Parameter description

Option	Description
`timestamp`	Token generation time (must comply with ISO 8601 format)
`site_id`	Site ID issued from the DoveRunner service
`policy`	A string defining the license policy (playback validity period, play count, etc.)
`cid`	Kollus upload file key Where to find: Kollus VOD console > [Library] > Click content title > [Overview] tab

Learn more

For a guide on configuring license token data, refer to the official documentation.

JWT technical specifications​

Encryption algorithm​

Authentication keys​

Security key​

Custom key​

JWT payload detailed specifications​

Required options example​

Basic options​

Content options (settings inside the mc array)​

DRM_policy object​

Data sub-options​

DRM detailed settings​

PlayReady​

Widevine​

FairPlay​

DoveRunner license token generation​

Token data structure​

Parameter description​