FairPlay — What Is It, Apple’s DRM and How It Works

What Is FairPlay?

FairPlay is a DRM technology created by Apple and built into the iOS, tvOS, iPadOS, and macOS operating systems to protect audio and video content from unauthorized use. Originally developed for iTunes and iPod, it has evolved into a full-fledged content protection system for streaming content via the FairPlay Streaming protocol.

Unlike other DRM solutions, FairPlay is fully integrated into the hardware architecture of Apple devices. Decryption keys are stored in the Secure Enclave — a protected coprocessor isolated from the main OS, making key extraction virtually impossible even with a jailbreak.

Evolution of FairPlay

The history of FairPlay began in 2003 with the iTunes Store, where AAC file encryption was used with the proprietary M4P format. In 2009, Apple introduced FairPlay Streaming — a protocol for protecting HLS-based streaming video, which later became mandatory for Apple TV and iOS apps.

Starting with iOS 10 and tvOS 10, Apple opened FairPlay Streaming to third-party developers through the AVFoundation framework. Today, Netflix, Amazon Prime Video, and Disney+ use FairPlay to protect content on Apple devices up to 4K HDR resolution with Dolby Vision.

How Does FairPlay DRM Work?

How FairPlay works is based on a three-stage process: content packaging, distribution via CDN, and decryption on the device. At the packaging stage, video is encrypted using AES-128 or AES-256, and the encryption keys are tied to a specific device through the Key Envelope mechanism.

When requesting content, the player initiates a FairPlay session through AVContentKeySession, which sends a request to the content provider’s license server. The server verifies access rights and returns the decryption key encrypted with the public key of the device certificate.

License Acquisition Process

The client creates an instance of AVContentKeySession and adds the content track to it. The system generates an SPC (Server Playback Context) request, which contains the device identifier and the application certificate signed by Apple. This request is sent to the license server over HTTPS.

The license server validates the SPC, retrieves the content key from its database, and encrypts it with the device’s public key, forming a CKC (Content Key Context). The CKC is returned to the client, where AVContentKeySession decrypts it using the Secure Enclave’s private key.

FairPlay Streaming Workflow Diagram

let contentKeySession = AVContentKeySession(keySystem: .fairPlayStreaming)
contentKeySession.setDelegate(self, queue: .main)

let asset = AVURLAsset(url: streamURL)
asset.resourceLoader.setDelegate(self, queue: .main)
contentKeySession.addContentKeyRecipient(asset)

let playerItem = AVPlayerItem(asset: asset)
let player = AVPlayer(playerItem: playerItem)

Key FairPlay Components

FairPlay architecture includes several interconnected components: application certificate, Key Envelope, Secure Enclave, and content decryption module. Each component plays its role in the protection chain from the server to the user’s screen.

FairPlay Application Certificate

To work with FairPlay, a developer must obtain an FPS certificate from Apple through the Apple Developer program. The certificate includes the public key of an asymmetric pair, the private part of which is used by Secure Enclave to decrypt the CKC.

The application certificate is added to the project bundle and automatically signed at build time through Xcode. On the first playback of protected content, the system verifies the certificate’s validity and requests a license.

Secure Enclave and Hardware Protection

Secure Enclave is a dedicated coprocessor on Apple A-series and M-series chips, running on the isolated L4 OS. It is responsible for generating and storing private keys, decrypting the CKC, and passing the content key to the video decryption module.

All cryptographic operations are performed exclusively inside the Secure Enclave, and keys never leave the protected area. Side-channel attacks on the data bus between the Secure Enclave and the main processor are blocked by hardware integrity monitoring.

Integrating FairPlay in iOS and tvOS

FairPlay integration in iOS and tvOS apps is done through AVFoundation and requires implementing the AVContentKeySessionDelegate and AVAssetResourceLoaderDelegate protocols. The developer needs to handle four key events: receiving SPC, sending it to the server, receiving CKC, and passing it to the player.

Implementing AVContentKeySession Delegate

func contentKeySession(
    _ session: AVContentKeySession,
    didProvide keyRequest: AVContentKeyRequest
) {
    guard let identifier = keyRequest.identifier
    else { return }

    let spc: Data = keyRequest.makeStreamingContentKeyRequestData(
        appCertificate: certificate,
        contentIdentifier: identifier,
        options: nil
    )

    licenseService.requestCKC(spc) { ckc in
        keyRequest.processContentKeyResponse(
            AVContentKeyResponse(fairPlayStreamingKeyResponseData: ckc)
        )
    }
}

Preparing the Certificate and Content Identifier

Before starting playback, you need to load the application certificate from the bundle and prepare the content identifier (usually the stream URL or movie ID). The certificate must be valid for at least the duration of the content rental, otherwise licensing will fail.

The content identifier is passed to the licensing system at the SPC formation stage. The license server uses this identifier to find the corresponding key and playback policies, including time and device restrictions.

Handling Licensing Errors

Errors can occur during licensing: certificate expiration, invalid content identifier, lack of user access rights. FairPlay errors are returned through the contentKeySession:didFailWithError delegate and must be handled with appropriate UI shown to the user.

Typical error codes include FP_NO_ENTITLEMENT when there is no subscription and FP_REQUEST_TIMEOUT for network issues. It is recommended to implement retry logic with exponential backoff for temporary network failures.

FairPlay Streaming and Licensing

FairPlay Streaming is a protocol for protecting HLS-based streaming video that uses segment encryption and a time-limited key mechanism. The content provider deploys its own license server, which integrates with the user authentication system.

The license server receives an SPC request from the client, extracts the device and content identifiers, verifies the user’s rights in the backend, and forms a CKC response. The content key is encrypted with the device’s public key from the FPS certificate.

FairPlay Licensing Policies

A FairPlay license may contain time restrictions (48-hour rental), device limits (maximum 5 authorized devices), and playback quality restrictions (limited to 1080p for a basic plan). Policies are set on the server side and packaged into the Key Envelope.

It is important to note that FairPlay policies are enforced at the Secure Enclave level and cannot be bypassed by software methods at the OS level. Even with a jailbreak, the hardware protection prevents key extraction or license parameter modification.

FairPlay Comparison with Other DRM Solutions

FairPlay Behavior on Different iOS Versions

FairPlay Streaming support depends on the operating system version and device type. Since iOS 10 and tvOS 10, the AVContentKeySession API is available to all apps, but hardware acceleration through Secure Enclave is only required for 4K HDR content. On devices with A8–A10 chips, the maximum resolution is limited to 1080p.

In iOS 14, Apple added support for multiple FairPlay sessions, allowing an app to play several protected streams simultaneously — for example, picture-in-picture with different licenses. iOS 15 extended the protocol with background key renewal support for extended viewing sessions.

FairPlay in a Multi-DRM Architecture

For cross-platform streaming services, FairPlay is used as part of a multi-DRM architecture alongside Widevine and PlayReady. License aggregators such as Axinom and EZDRM provide a unified API that translates requests into SPC format for FairPlay and MediaDrm format for Widevine, simplifying integration across all platforms.