Build a multi-DRM license proxy that routes FairPlay SPC, Widevine license challenge, and PlayReady license requests to the correct backend based on the requesting CDM

Steps

1. Encrypt content once with CENC (or cbcs for FairPlay compatibility) and embed one PSSH box per DRM system (Widevine, PlayReady) at packaging time using a tool like Shaka Packager or Bento4; FairPlay does not use a PSSH box and is keyed separately via its own certificate flow
2. On the client, rely on the browser's Encrypted Media Extensions (EME) implementation to have its CDM parse the pssh box matching its own system ID and issue a DRM-specific license request
3. Implement a single license-proxy endpoint that inspects the incoming request (explicit drm-system parameter, Content-Type, or player-supplied header) and forwards it to the matching backend: Widevine's serialized protobuf challenge, PlayReady's XML SOAP challenge, or FairPlay's raw SPC binary blob
4. For FairPlay specifically, first serve the FairPlay application certificate to the client so it can generate a valid Server Playback Context (SPC), then forward that SPC to your FairPlay key server and return its Content Key Context (CKC) response unmodified to the player
5. Enforce your own authorization/entitlement check inside the proxy before forwarding any license request, since DRM key delivery alone is not an access-control layer
6. Test playback against at least one device per DRM system (a Widevine-based browser, a PlayReady-based device, and Safari/tvOS for FairPlay) since a packaging or signaling bug often only breaks one CDM