FairPlay

FairPlay in C21 Live Control

FairPlay is Apple's DRM. It reaches Safari, iOS, iPadOS, tvOS and macOS — the Apple device ecosystem. In Live Control it appears as one of the three systems exposed by DrmProvider.supported_systems and one of the values a Destination's drm.systems[] array can carry.

This page covers what goes into the provider record when the upstream multi-DRM service supports FairPlay. For the end-to-end flow, see DRM workflow. For the provider catalogue and CRUD, see Providers.

Where the configuration comes from

FairPlay integrations are issued by Apple to content owners. The upstream multi-DRM vendor (for example AXINOM or EZDRM) handles the FairPlay Streaming (FPS) handshake on the customer's behalf: it manages the FairPlay certificate, derives content keys, and serves the Content Key Context (CKC) response when a player issues a Server Playback Context (SPC) request.

The vendor hands over the same SPEKE endpoint and credentials used for Widevine and PlayReady — there is no separate FairPlay form in Live Control. The provider record's supported_systems declares whether the vendor's FairPlay support is enabled for this account.

Packaging requirement: CBCS

FairPlay only consumes content encrypted in cbcs mode (AES-CBC with subsample-based pattern encryption). A Destination with systems = [FairPlay] requires encryption_mode = cbcs. To reach Widevine + PlayReady clients alongside FairPlay, register a separate Destination with systems = [Widevine, PlayReady] pointing at the same cbcs packaging — the API rejects combining FairPlay with Widevine or PlayReady on a single Destination.

Attaching FairPlay to a Destination

DRM is applied to a Destination via its drm block (see Destinations):

• active = true.
• provider_id set to the FairPlay-capable provider.
• systems = ['FairPlay']. The usual combination is Apple-only. If the deploy also needs Widevine + PlayReady, create a separate Destination with those two systems — the API does not accept FairPlay combined with others on a single row.
• encryption_mode = cbcs (the server derives it when systems includes FairPlay).
• contentid set to the content identifier the upstream vendor expects.

FAQ