Meta tags:
description=The JWT Claims are represented as a JSON object. Verimatrix uses registered claim names, public claim names, and private claim names in the formation of requests. All claim names and values are case sensitive. Claim Names This section describes the claims that may be present in the JWT. alg (Algor…;

Headings (most frequently used words):

claim, streamkeeper, token, id, access, restriction, authorization, overview, multi, drm, faqs, verimatrix, platform, names, carriage, refresh, alg, algorithm, kid, key, exp, expiration, time, nbf, not, before, iat, issued, at, jti, jwt, iss, issuer, ver, version, aud, audience, sub, subject, bypass_geo_blocking, bypass_vpn_blocking, drm_protocol, trust, tunnel, example, what, next,

Text of the page (most frequently used words):
the (129), for (41), claim (37), token (30), verimatrix (26), and (20), your (20), must (14), jwt (14), app (14), drm (12), time (12), request (12), key (11), required (11), when (11), status (11), not (10), #authorization (10), cpix (10), present (10), application (9), information (9), seconds (9), multi (9), streamkeeper (9), license (8), payload (8), please (8), contact (8), representative (8), further (8), iat (8), client (8), claims (8), codes (8), counterspy (8), use (7), example (7), issued (7), dashboard (7), case (6), expiry (6), with (6), widevine (6), are (6), content (6), maximum (6), overview (6), ios (6), this (5), specific (5), authentication (5), that (5), before (5), within (5), http (5), audience (5), fairplay (5), sub (5), exp (5), set (5), requests (5), clock (5), skew (5), names (5), android (5), should (4), certificate (4), signing (4), playready (4), ver (4), test (4), drm_protocol (4), identifies (4), blocking (4), platform (4), version (4), data (4), lifespan (4), age (4), represented (4), service (4), activity (4), api (4), all (3), page (3), rotation (3), defined (3), json (3), code (3), invalid (3), expired (3), keys (3), used (3), purpose (3), urn (3), issuer (3), included (3), public (3), error (3), kid (3), aud (3), optional (3), vpn (3), may (3), system (3), access (3), registered (3), specification (3), expiration (3), allowed (3), indicates (3), since (3), start (3), epoch (3), nbf (3), getting (3), started (3), create (3), security (3), deepscan (3), reveal (3), integration (3), protection (3), guides (3), rights (2), privacy (2), terms (2), com (2), verify (2), playback (2), user (2), refresh (2), packager (2), parsing (2), body (2), either (2), tokens (2), cannot (2), 401 (2), signature (2), query (2), append (2), url (2), header (2), matches (2), multidrm (2), has (2), using (2), generation (2), uses (2), alg (2), iss (2), jti (2), protocol (2), trust (2), tunnel (2), absent (2), false (2), standard (2), rules (2), applied (2), configured (2), denied (2), bypass_vpn_blocking (2), true (2), instructs (2), skip (2), verification (2), restriction (2), geo (2), bypass_geo_blocking (2), subject (2), match (2), value (2), allows (2), which (2), accepted (2), processing (2), recommended (2), guide (2), managing (2), drms (2), frequently (2), asked (2), questions (2), faqs (2), supported (2), monitoring (2), signed (2), encryption (2), watermarking (2), faq (2), setup (2), view (2), troubleshooting (2), protecting (2), preparing (2), talk (2), markdown (2), 2025, reserved, notice, www, copy, did, help, you, yes, what, next, updated, days, ago, valid, starts, puts, into, background, however, finds, prior, sent, validated, boundaries, configuration, assets, where, demand, minimum, round, trip, retrieve, recording, created, find, reversing, base, encoding, monitor, can, authorized, result, wrong, possible, alter, headers, instance, then, parameter, instead, placed, fixed, string, selected, owner, company1, passed, equal, marked, referenced, will, failure, results, 503, due, send, every, servers, entitlement, control, message, returned, carriage, typ, bbb, 1541974700, 1541974820, subscriber, rest, trusttunnel, adhere, specified, operator, permissive, mode, detected, connecting, via, anonymous, based, geographic, location, identifier, requested, documented, limited, scope, requesting, scrambler, number, structure, numeric, references, versions, year, minutes, 120, future, allowing, controlled, was, calculated, exceeds, see, below, reduced, after, algorithm, section, describes, values, sensitive, object, private, formation, trial, secure, delivery, setting, sso, risk, detections, quick, multifactor, mfa, roles, users, how, three, major, identify, devices, google, decryption, module, cdm, handling, billing, models, omi, ott, iptv, vcas, enhanced, live, apple, streaming, hdcp, compatibility, best, practices, parameters, document, hardening, requirements, player, package, encrypt, consumer, generate, configure, tiers, comparison, email, alerting, usage, description, retention, event, management, siem, gdpr, liveboost, build, automation, features, platforms, apps, table, testing, protected, threat, responses, threat_responses, custom_protection, generating, developer, uploading, building, introduction, interface, search, home, jump, agents, visit, https, docs, llms, txt, index, pages, formatted, endpoints, openapi, any, documentation, get, its,

Text of the page (random words):
authorization overview verimatrix streamkeeper counterspy faqs for ai agents visit https docs verimatrix com llms txt for an index of all pages formatted in markdown and endpoints in openapi append md to any documentation page url to get its markdown version jump to content home guides talk to us guides search talk to us guides authorization overview authorization overview streamkeeper streamkeeper counterspy getting started with counterspy protection introduction to the counterspy interface counterspy for android preparing your android app building your app uploading your app protecting your android app generating an app signing certificate for a developer signed app signing your android app test your app troubleshooting your android app protection custom_protection threat_responses threat responses counterspy for ios preparing your ios app protecting an ios app signing your ios app testing your protected ios app troubleshooting your ios app protection counterspy dashboard getting started with dashboard dashboard view table view managing registered apps features and supported platforms build automation ci cd integration liveboost api faq data privacy and gdpr security information and event management siem integration data retention data description api usage email alerting counterspy tiers comparison streamkeeper multi drm create a service access key configure drms for playready widevine and fairplay generate tokens for authorization package and encrypt content for consumer playback test your setup with verimatrix s test player multi drm status codes streamkeeper multi drm status codes client status codes client status codes authorization client status codes cpix client status codes widevine client status codes fairplay client status codes playready token authentication specification system overview security hardening requirements key generation authorization overview drm application specific token authentication widevine claims fairplay claims playready claims cpix claims cpix document encryption cpix query parameters cpix best practices hdcp compatibility drm specific integration apple fairplay streaming certificate setup guide streamkeeper multi drm monitoring watermarking reveal and deepscan reveal service vs deepscan reveal deepscan watermarking frequently asked questions faq cpix service api create content use case live with key rotation use case multi key use case key encryption cpix enhanced security api create content use case signed request vcas monitoring getting started iptv activity dashboard multi drm activity dashboard ott activity dashboard omi activity dashboard supported billing models widevine license request handling streamkeeper multi drm faqs frequently asked questions google widevine content decryption module cdm how the three major drms identify devices verimatrix platform managing users platform user roles multifactor authentication mfa risk detections quick guide setting up sso terms of service for trial use of verimatrix secure delivery platform streamkeeper streamkeeper multi drm token authentication specification authorization overview the jwt claims are represented as a json object verimatrix uses registered claim names public claim names and private claim names in the formation of requests all claim names and values are case sensitive claim names this section describes the claims that may be present in the jwt alg algorithm claim required please contact your verimatrix representative for further information kid key id claim required please contact your verimatrix representative for further information the kid claim must be present in the header of the jwt exp expiration time claim recommended the exp expiration time claim indicates a time after which a jwt must not be accepted for processing and is represented as seconds since the start of the epoch if the calculated token lifespan exceeds the maximum allowed token age see iat issued at claim below it is reduced to the maximum allowed token age if included the exp claim must be present in the payload of the jwt nbf not before claim recommended the nbf not before claim indicates a time that before which a jwt must not be accepted for processing the time is represented as seconds since the start of the epoch verimatrix allows for 5 seconds of clock skew if included the nbf claim must be present in the payload of the jwt iat issued at claim required the iat issued at claim indicates when the jwt was issued and is represented as seconds since the start of the epoch the issued at time must not be in the future allowing 5 seconds of clock skew for license requests the token age is controlled by either the exp expiration time claim or the maximum allowed token age for multi drm requests the maximum lifespan is iat 120 seconds 5 seconds of clock skew for cpix v1 requests the maximum lifespan is iat 30 minutes 5 seconds of clock skew for cpix v2 requests the maximum lifespan is iat 1 year 5 seconds of clock skew the iat claim must be present in the payload of the jwt jti jwt id claim required please contact your verimatrix representative for further information iss issuer claim required please contact your verimatrix representative for further information ver version claim required the ver version claim identifies the version number of the json data structure in the payload this is a numeric value that references specific versions of the verimatrix token specification the ver claim must be present in the payload of the jwt aud audience claim required the aud audience claim identifies the purpose of the issued token it allows a token to be issued with a limited scope for example a license request token cannot be used for requesting scrambler keys audience claims are defined by verimatrix and documented within the application specific claims the audience must match the registered key purpose within the verimatrix platform sub subject claim required the sub subject claim identifies the content it must match the value used for the identifier when the keys are requested the sub claim must be present in the payload of the jwt bypass_geo_blocking access restriction claim optional the bypass_geo_blocking claim when present and set to true instructs the system to skip geo blocking verification for the request when absent or set to false standard geo blocking rules are applied when configured and the request may be denied based on the geographic location of the client bypass_vpn_blocking access restriction claim optional the bypass_vpn_blocking claim when present and set to true instructs the system to skip vpn blocking verification for the request when absent or set to false standard vpn blocking rules are applied when configured and the request may be denied if the client is detected as connecting via an anonymous vpn drm_protocol trust tunnel claim optional the drm_protocol claim identifies the required protocol when the operator is using permissive trust tunnel mode when present the drm_protocol claim must be set to rest or trusttunnel in the payload of the jwt the license request must adhere to the protocol specified by the drm_protocol claim example alg please contact your verimatrix representative for further information typ jwt kid please contact your verimatrix representative for further information ver 1 iss please contact your verimatrix representative for further information sub bbb iat 1541974700 exp 1541974820 jti please contact your verimatrix representative for further information subscriber test sub aud urn verimatrix multidrm token carriage send the token with every request to the verimatrix license servers for playready widevine or fairplay verimatrix uses the token for entitlement and drm rights control if the token is invalid an http error 401 status code and error message is returned license generation failure results in an http error 503 status code for example due to an invalid license request body verimatrix will verify the signature using the public key of the certificate this is referenced by the issuer the public key signing the token is not marked as expired the token has not expired not before if included has passed or equal to the issuer matches the owner of the certificate for example company1 the audience matches the fixed string for the selected application for example urn verimatrix multidrm urn verimatrix cpix the token should be placed as an authorization header within the http request as authorization token if it is not possible to alter the http headers for instance within a packager then use a query parameter instead append the url as x authorization token tokens that cannot be authorized result in a http status code 401 for example an invalid signature expired request or keys used for the wrong purpose token refresh the application should monitor the expiry time of the token the application can do this by either parsing the payload of the token to find expiry time by reversing the base 64 encoding and parsing the json body recording the expiry time of the token when it is created however the application finds the expiry time it should refresh the token prior to expiry the token is sent and validated at key rotation boundaries as defined within the packager configuration for assets where key rotation is not required for example on demand the token expiry time must be defined to the minimum required for the round trip to retrieve the license the application should verify that the token is valid before playback starts in case the user puts the application into the background updated 18 days ago what s next drm application specific token authentication did this page help you yes no copy page www verimatrix com terms of use privacy notice 2025 verimatrix all rights reserved