Configure ClearKey as a testing content-protection mechanism for CENC-encrypted content
domain: w3.org · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Confirm the manifest signals CENC protection and that the player's EME stack supports org.w3.clearkey (the EME spec requires all EME-supporting browsers to implement Clear Key).
For local/offline testing, configure the player directly with a key-ID-to-key hex map (e.g. Shaka Player's drm.clearKeys) — this bypasses any license server and forces Clear Key decryption regardless of manifest contents.
For manifest-driven ClearKey, instead configure a license server URL for the org.w3.clearkey key system so the player performs a real EME license request.
Player builds a JSON license request per the EME spec's Clear Key request format and POSTs it to that server.
Server responds using the EME spec's Clear Key license format (JSON mapping key IDs to raw keys), which the CDM uses to decrypt the content.
Known gotchas
Keys are unencrypted by design, so ClearKey provides no real content protection — it exists for EME interoperability testing/diagnostics, not production rights enforcement.
Directly-configured keys (e.g. drm.clearKeys) override whatever key system the manifest declares — convenient for isolated tests, but will mask real license-server integration bugs if left enabled.
ClearKey enforces no usage rules/policy at all, so testing against it doesn't validate the rights-enforcement behavior of production DRM (Widevine/PlayReady/FairPlay).
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?