Build an Apple experience, not a browser workaround
FairPlay Streaming is the DRM path for protected HLS on supported Apple playback environments. DRM-X connects that path to your content publishing and server authorization workflow, while AVFoundation or the supported Safari player integration handles the device-side exchange.
Choose and test the actual playback stack: a native Apple application and a Safari web player do not have identical lifecycle or compatibility behavior. Package encrypted HLS for the intended platform and test the operating-system versions, codecs and resolution combinations your service promises.
Treat certificates and private credentials differently
The application certificate is a public input used by the player to construct a challenge. The private FairPlay credentials and server-side implementation material are not player assets. Keep them off the website, application bundle and downloadable customer sample.
A production integration requires the applicable Apple permissions and approved FairPlay credential setup. In DRM-X, playback must use the active deployment associated with the selected Environment, or an explicitly configured same-organization default. Activating a different customer's credentials is not an acceptable fallback.
Follow the certificate → SPC → CKC sequence
First authenticate the viewer on your backend and authorize the requested Published Content ID. Return the trusted FairPlay configuration, public certificate reference and bounded license authorization. Your app or web player loads the certificate and asks the Apple media framework to create an SPC challenge.
Send the exact challenge bytes to the configured license endpoint. Return the CKC bytes in the form expected by your player integration. Encoding, content type and response wrapping are common integration mistakes: do not apply an arbitrary JSON or base64 conversion unless that specific client contract requires it. Release the streaming reservation when the viewing attempt ends.
- Approved and active credential deployment
- Correct HLS encryption and content identifiers
- Certificate retrieval and exact SPC/CKC handling
- Real Safari or Apple-device playback tests
Plan native offline viewing independently
Apple offline viewing uses platform-specific native download and persistent content-key APIs. It is not the same implementation as Android's Widevine key-set storage, and an ordinary Safari streaming integration should not be advertised as a downloadable offline application.
If Apple offline or on-board viewing is required, define the native application, rights, lifecycle and device acceptance with Haihaisoft before deployment. The DRM-X Android AAR is not a FairPlay SDK. The shared license-service architecture can simplify your backend, but each platform still needs its own correctly implemented client path.
Common questions
Should I put the FairPlay private key in my app?
No. Only the public application certificate belongs in the client exchange. Private credentials remain protected server-side.
Can I reuse the Android Widevine implementation?
Reuse your authentication and entitlement concepts, not the device-side code. FairPlay uses a different native framework and SPC/CKC exchange.
Is Apple approval included automatically?
No. Applicable Apple permissions, credentials and content rights must be established for the customer deployment.
Platform background: Apple FairPlay Streaming. Product behavior and deployment scope are described above; platform capabilities do not imply every customer deployment is qualified.