# AES-128 Keys

> Part of the [SpatialGen API documentation](/index.md). [HTML version of this page](/security/aes128-key/).

Request an AES-128 content key for HLS playback.

## API context

-   DRM base URL: `https://drm.spatialgen.com`.
-   Authenticate requests to SpatialGen API endpoints with the `X-SPATIALGEN-APPKEY` HTTP header.
-   Use a key from the workspace that owns the requested resources. Follow the roles and scopes specified for each endpoint below.
-   Keep `admin` and `upload` keys on a trusted backend. `readonly` keys may be used in client apps for permitted read operations.
-   Send DRM key and license requests through your backend, keeping the SpatialGen API key there.

See the [API key guide](/guides/get-started.md) for roles, key creation, expiration, revocation, and rotation.

* * *

Beta

## Getting Started

SpatialGen supports AES-128 encrypted HLS playback. This endpoint is in Beta and may change. Reach out to [contact@spatialgen.com](mailto:contact@spatialgen.com) for Beta acce.

## AES-128 Streaming Workflow

During playback, your app requests a content key through your server. Your server sends the video’s **Asset ID** to `drm.spatialgen.com` with your API key. Keep the API key on your server.

SpatialGen returns the content key as a base64 encoded string. Decode it into 16 raw bytes before passing it to the player. The IV is declared in the HLS playlist as defined in the HLS AES-128 spec.

### Requesting Content Keys

**POST** `/aes128/key`

Send `asset_id` in a JSON body with your API key in the `X-SPATIALGEN-APPKEY` header. Your workspace must have DRM enabled. V2 API keys need the `videos:read` scope.

A successful request returns a JSON object containing the base64 encoded content key in the `key` field.

HLS players normally fetch keys with GET. Use Shaka request and response filters, or your server, to send this POST request and decode the JSON response for the player.

#### Example Request

fetchAes128Key.js

```js
// Example data to send
const data = {
  asset_id: "<asset_id>"
};

// Fetch call from your server
fetch('https://drm.spatialgen.com/aes128/key', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-SPATIALGEN-APPKEY': apiKey
  },
  body: JSON.stringify(data)
})
```

#### Example Response

response

```json
{
  "key": "<base64 encoded content key>"
}
```