# Google Widevine DRM

> Part of the [SpatialGen API documentation](/index.md). [HTML version of this page](/security/widevine-drm/).

Implementing Google Widevine DRM with SpatialGen

## API context

-   DRM base URL: `https://drm.spatialgen.com`.
-   Authenticate requests to SpatialGen API endpoints with the `X-SPATIALGEN-APPKEY` HTTP header.
-   Use a key from the workspace that owns the requested resources. Follow the roles and scopes specified for each endpoint below.
-   Keep `admin` and `upload` keys on a trusted backend. `readonly` keys may be used in client apps for permitted read operations.
-   Send DRM key and license requests through your backend, keeping the SpatialGen API key there.

See the [API key guide](/guides/get-started.md) for roles, key creation, expiration, revocation, and rotation.

* * *

## Getting Started

SpatialGen supports Widevine DRM to secure your video content. Reach out to the team at [contact@spatialgen.com](mailto:contact@spatialgen.com) and they can help you add Widevine to your account.

## Widevine Streaming Workflow

During playback, your app will need to request a license for your encrypted videos. SpatialGen DRM is hosted at `drm.spatialgen.com`, and all requests in the Widevine workflow will be made to this URL.

The Widevine workflow requires two pieces of information from your app. The stream’s DRM metadata contains a **Key ID (KID)** to identify the encryption key. When playback of a Widevine video begins, the device’s hardware **Content Decryption Module (CDM)** generates a **license challenge** from the media’s initialization data.

Both the Key ID and license challenge will be sent to the SpatialGen DRM server, where the request will be validated and a **Widevine license** returned. Your app will pass this license to the CDM to decrypt and play the encrypted video.

### Requesting Licenses

**POST** `/widevine/license`

Send a POST request to the SpatialGen DRM server with the license challenge and Key ID to receive a license. The body of the POST request should contain `license_challenge` and `key_id` in JSON format. The license challenge should be sent as a _base64 encoded string_.

The Key ID must be a 16-byte KID formatted as a hyphenated UUID or `0x` followed by 32 hexadecimal digits. Use the KID from the stream’s DRM metadata. The decoded license challenge must not exceed 1 MiB.

A successful request will return a JSON object containing the license as a base64 encoded string in the `license` field. Your app will be responsible for decoding the license into raw bytes before passing it to the CDM for playback.

#### Example Request

fetchWidevineLicense.js

```js
// Example data to send
const data = {
  key_id: "<key_id>",
  license_challenge: "<base64 encoded license challenge>"
};

// Fetch call
fetch('https://drm.spatialgen.com/widevine/license', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-SPATIALGEN-APPKEY': apiKey
  },
  body: JSON.stringify(data)
})
```

#### Example Response

response

```json
{
  "license": "<base64 encoded Widevine license>"
}
```