What Is FairPlay Streaming? Apple's DRM Explained

So what is FairPlay Streaming? It is Apple’s digital rights management system for video, and it is the only DRM that plays protected streams natively on iPhone, iPad, Apple TV, Apple Vision Pro and in Safari on the Mac. If your paid video has to work on Apple devices, you will meet FairPlay sooner or later.

Most people know it without knowing the name. Every film you rent in the Apple TV app uses it. So do Netflix, Disney+ and Prime Video when you watch on an iPhone.

This guide explains how FairPlay Streaming (FPS) works, what you need to deploy it, how it fits alongside Widevine and PlayReady, and the errors that trip up most first-time integrations.

A short history

The FairPlay name goes back to 2003, when Apple used it to protect music bought from the iTunes Store. That version was retired for music in 2009. FairPlay Streaming, the system used today, arrived in 2015 alongside iOS 9 and was built specifically for HTTP Live Streaming. When people say “FairPlay” in a streaming context, they almost always mean FPS.

Where FairPlay works

FairPlay is built into Apple’s own software:

• iOS and iPadOS apps using AVFoundation.
• tvOS on Apple TV.
• macOS apps, and Safari on the Mac.
• Safari on iPhone and iPad.
• visionOS on Apple Vision Pro.

It does not work in Chrome, Firefox or Edge, even on a Mac, and it does not work on Android or Windows. That limitation is why every cross-platform service ends up running multi-DRM: FairPlay for Apple, and Widevine or PlayReady for everyone else.

How FairPlay Streaming works

The flow has more steps than you might expect, but each one is logical once you see what it protects.

1. The content is encrypted

Video segments are encrypted with AES-128 using the cbcs scheme, a pattern of encrypted and clear blocks defined in the Common Encryption standard. In HLS playlists this shows up as an #EXT-X-KEY or #EXT-X-SESSION-KEY tag with METHOD=SAMPLE-AES and a KEYFORMAT of com.apple.streamingkeydelivery. The key URI usually starts with skd:// and carries an identifier your key server understands.

2. The player fetches your application certificate

Before it can ask for a key, the player needs your FairPlay application certificate. This is a public certificate that Apple issues to you as part of the deployment package. Web players download it from a URL you host. Native apps often bundle it.

3. The device builds an SPC

Using the certificate and the content identifier, the device creates a Server Playback Context (SPC). The SPC is an encrypted request that only your key server can read. It proves which device is asking and carries a session key the server will use to wrap its answer.

4. Your key server answers with a CKC

Your Key Security Module (KSM) decrypts the SPC with the private key and secret that Apple gave you, checks that the viewer is allowed to watch, and returns a Content Key Context (CKC). The CKC contains the content key, wrapped so that only that device can open it, plus rules such as how long the key lasts.

5. The device decrypts and plays

The device unwraps the key inside its secure hardware and decrypts the video. On modern Apple hardware, keys and decoded frames stay inside protected parts of the system, which is why Apple devices are trusted for high-resolution playback.

Put simply: certificate out, SPC up, CKC down, video on screen.

What you need to deploy FairPlay

To run FairPlay yourself you need:

1. An Apple Developer Program membership.
2. The FairPlay Streaming deployment package. You request it through your developer account. Apple asks about your business and use case before approving it. The package gives you an application certificate, a private key and an “application secret key” (ASk).
3. A key server (KSM) that can parse SPCs and build CKCs. Apple provides a reference implementation in its server SDK, but most teams do not build their own.
4. HLS packaging with cbcs encryption and the right key tags in your playlists.
5. A player that supports FairPlay: AVPlayer in native apps, or a web player that uses Safari’s EME support.

In practice, nearly every small or mid-sized business skips steps 2 and 3 by using a DRM vendor. The vendor holds its own FairPlay credentials and runs the KSM. You point your player at their endpoints and pass your own authentication token. Our multi-DRM guide lists the main vendors.

FairPlay in the browser

Safari supports FairPlay through Encrypted Media Extensions. Modern Safari exposes the key system as com.apple.fps, while older code used a prefixed WebKit API and the com.apple.fps.1_0 string. If you are writing your own player code, our guide to Encrypted Media Extensions covers the general flow, with one extra step for FairPlay: call setServerCertificate() with your application certificate before generating a request.

You can see whether a given browser offers FairPlay with our DRM support checker. In Safari the FairPlay rows show “Yes”. Everywhere else they show “No”.

Offline playback

FairPlay handles downloads well, which is one reason it is popular for travel, fitness and education apps. An iOS app can download an HLS asset with AVFoundation, request a persistable content key and store it alongside the video. Your CKC sets how long that key stays valid, for example 30 days from download and 48 hours from first play for a rental. When it expires, the app asks the key server for a new one the next time the device is online.

Two practical tips. First, request the persistable key before the download finishes, so a viewer who loses connection at the end still has a working file. Second, handle key expiry in the interface, with a clear message, rather than letting playback fail silently on a plane.

Security levels and quality

FairPlay does not expose named levels like Widevine’s L1 and L3, but the idea is similar. On current iPhones, iPads, Apple TVs and Apple silicon Macs, decryption and decoding are hardware-protected, and services treat these devices as high-security. That is why Safari on a Mac can often stream in higher quality than Chrome on the same machine, a difference we explain in why Netflix plays in low quality on PC.

Output protection still applies. For 4K, the connected display chain must support HDCP 2.2, and AirPlay to a TV follows the receiving device’s rules.

Common FairPlay errors and fixes

Playback fails before any key request. The player could not load your application certificate. Check the certificate URL, CORS headers and that you are serving the correct .cer file.

The key server returns an error. Often the SPC was built with the wrong certificate, or the content identifier in the skd:// URI does not match what the server expects. Log the identifier on both sides.

It plays in the app but not in Safari. Web playback needs EME-specific code and, again, the certificate. Test with a known-good FairPlay demo stream to split player problems from packaging problems.

Audio plays, video is black. Check that video segments use cbcs. Content encrypted only with cenc (AES-CTR) will not play under FairPlay.

Downloaded content stops working. The persistable key has expired, or the app deleted it. Check your expiry values and your app’s key storage logic.

AirPlay shows a black screen. Protected content over AirPlay depends on the receiving device and its HDCP chain. Try a direct connection to rule out the TV side.

FairPlay compared with Widevine and PlayReady

All three systems do the same basic job. The differences are practical:

• FairPlay covers Apple devices, and only with HLS.
• Widevine covers Chrome, Firefox, Android and many TVs.
• PlayReady covers Edge on Windows, Xbox and many smart TVs.

With CMAF segments encrypted using cbcs, one set of files can serve all three. Only the manifests and licence calls differ. The detailed comparison is in Widevine vs FairPlay vs PlayReady, and if you are still weighing whether you need DRM at all, start with how to protect videos from being downloaded.

A launch checklist

• Decide whether to request your own deployment package or use a vendor. For most teams, use a vendor.
• Package HLS with cbcs encryption and the FairPlay key format.
• Host your application certificate with CORS enabled.
• Issue short-lived playback tokens from your backend and pass them with every key request.
• Test on an iPhone, an iPad, Safari on a Mac and an Apple TV before launch.
• Test downloads and key expiry if you offer offline viewing.
• Log key server errors with the content identifier and device type, so support tickets become quick fixes.

Summary

FairPlay Streaming is Apple’s DRM for HLS. The device fetches your certificate, sends an encrypted SPC to your key server, receives a CKC with the content key and decrypts the video in protected hardware. It is required for protected playback on Apple devices, it supports downloads with expiring keys, and it shares cbcs-encrypted files with Widevine and PlayReady in a multi-DRM setup. Most businesses reach it through a DRM vendor rather than building a key server themselves.