How to integrate AWS Elemental MediaConvert using SPEKE

1. Introduction

This section will introduce how to integrate AWS Elemental MediaConvert with Sigma DRM using the SPEKE 2.0 protocol over CPIX 2.3 standard. Below is our KMS information:

Environment	Base URL
Staging	https://api-staging.sigmadrm.com
Production	https://api.sigmadrm.com

2. SPEKE Ingest API

Request:
- Path: /assets/ingest/speke/{:merchantId}/{:appId}
- Method: POST
- Headers:
  - content-type: application/xml
  - X-Speke-Version: 2.0
  - Authorization: Basic {CredentialToken} (or x-access-token)
- Params:
Field Name Type Description
merchantId String Merchant account id
appId String App ID
- Body: CPIX Request

Field Name	Type	Description
merchantId	String	Merchant account id
appId	String	App ID

Sample CPIX Request (XML)

xml

<?xml version="1.0" encoding="UTF-8"?>
<cpix:CPIX contentId="mediaconvert_1" version="2.3" xmlns:cpix="urn:dashif:org:cpix" xmlns:pskc="urn:ietf:params:xml:ns:keyprov:pskc" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:enc="http://www.w3.org/2001/04/xmlenc#">
    <cpix:ContentKeyList>
        <cpix:ContentKey kid="4a78feac-0fad-4008-82f5-91c736d74d66" commonEncryptionScheme="cbcs"></cpix:ContentKey>
        <cpix:ContentKey kid="4331b35a-2cdd-4892-ac07-ed17328c5bac" commonEncryptionScheme="cbcs"></cpix:ContentKey>
    </cpix:ContentKeyList>
    <cpix:DRMSystemList>
        <cpix:DRMSystem kid="4a78feac-0fad-4008-82f5-91c736d74d66" systemId="edef8ba9-79d6-4ace-a3c8-27dcd51d21ed">
            <cpix:PSSH />
            <cpix:ContentProtectionData />
            <cpix:HLSSignalingData playlist="media"></cpix:HLSSignalingData>
            <cpix:HLSSignalingData playlist="master"></cpix:HLSSignalingData>
        </cpix:DRMSystem>
        <cpix:DRMSystem kid="4331b35a-2cdd-4892-ac07-ed17328c5bac" systemId="edef8ba9-79d6-4ace-a3c8-27dcd51d21ed">
            <cpix:PSSH />
            <cpix:ContentProtectionData />
            <cpix:HLSSignalingData playlist="media"></cpix:HLSSignalingData>
            <cpix:HLSSignalingData playlist="master"></cpix:HLSSignalingData>
        </cpix:DRMSystem>
    </cpix:DRMSystemList>
    <cpix:ContentKeyPeriodList>
        <cpix:ContentKeyPeriod id="keyPeriod_a2390064-8f91-42db-bc95-3591baf45f9d" index="0"/>
    </cpix:ContentKeyPeriodList>
    <cpix:ContentKeyUsageRuleList>
        <cpix:ContentKeyUsageRule kid="4a78feac-0fad-4008-82f5-91c736d74d66" intendedTrackType="VIDEO">
            <cpix:KeyPeriodFilter periodId="keyPeriod_a2390064-8f91-42db-bc95-3591baf45f9d"/>
            <cpix:VideoFilter />
        </cpix:ContentKeyUsageRule>
        <cpix:ContentKeyUsageRule kid="4331b35a-2cdd-4892-ac07-ed17328c5bac" intendedTrackType="AUDIO">
            <cpix:KeyPeriodFilter periodId="keyPeriod_a2390064-8f91-42db-bc95-3591baf45f9d"/>
            <cpix:AudioFilter />
        </cpix:ContentKeyUsageRule>
    </cpix:ContentKeyUsageRuleList>
</cpix:CPIX>

Response: CPIX Response

Sample CPIX Response (XML)

xml

<?xml version="1.0" encoding="UTF-8"?>
<cpix:CPIX xmlns:cpix="urn:dashif:org:cpix" xmlns:pskc="urn:ietf:params:xml:ns:keyprov:pskc" contentId="mediaconvert_1" version="2.3">
    <cpix:ContentKeyList>
        <cpix:ContentKey kid="c798e6ea-0098-462a-830b-dbc21fbd9c5e" commonEncryptionScheme="cbcs" explicitIV="AAAAAAAAAAAAAAAAAAAAAA==">
            <cpix:Data>
                <pskc:Secret>
                    <pskc:PlainValue>hBUYISoDSMh0rOjk56doBw==</pskc:PlainValue>
                </pskc:Secret>
            </cpix:Data>
        </cpix:ContentKey>
        <cpix:ContentKey kid="01e5a62d-a0ef-4bae-8773-7a51b2765109" commonEncryptionScheme="cbcs" explicitIV="AAAAAAAAAAAAAAAAAAAAAA==">
            <cpix:Data>
                <pskc:Secret>
                    <pskc:PlainValue>aqO27gWjE+JawLgodjAIeg==</pskc:PlainValue>
                </pskc:Secret>
            </cpix:Data>
        </cpix:ContentKey>
    </cpix:ContentKeyList>
    <cpix:DRMSystemList>
        <cpix:DRMSystem kid="c798e6ea-0098-462a-830b-dbc21fbd9c5e" systemId="edef8ba9-79d6-4ace-a3c8-27dcd51d21ed">
            <cpix:PSSH>AAAAc3Bzc2gBAAAA...zxombBg==</cpix:PSSH>
            <cpix:ContentProtectionData>PGNlbmM6cHNza...bWJCZz09PC9jZW5jOnBzc2g+</cpix:ContentProtectionData>
            <cpix:HLSSignalingData playlist="media">I0VYVC1YLUtFW...VJTU1PTlM9IjEi</cpix:HLSSignalingData>
            <cpix:HLSSignalingData playlist="master">I0VYVC1YLVNFU...VJTU1PTlM9IjEi</cpix:HLSSignalingData>
        </cpix:DRMSystem>
        <cpix:DRMSystem kid="01e5a62d-a0ef-4bae-8773-7a51b2765109" systemId="edef8ba9-79d6-4ace-a3c8-27dcd51d21ed">
            <cpix:PSSH>AAAAc3Bzc2gBAAAA...zxombBg==</cpix:PSSH>
            <cpix:ContentProtectionData>PGNlbmM6cHNza...bWJCZz09PC9jZW5jOnBzc2g+</cpix:ContentProtectionData>
            <cpix:HLSSignalingData playlist="media">I0VYVC1YLUtFW...VJTU1PTlM9IjEi</cpix:HLSSignalingData>
            <cpix:HLSSignalingData playlist="master">I0VYVC1YLVNFU...VJTU1PTlM9IjEi</cpix:HLSSignalingData>
        </cpix:DRMSystem>
    </cpix:DRMSystemList>
    <cpix:ContentKeyPeriodList>
        <cpix:ContentKeyPeriod id="keyPeriod_a2390064-8f91-42db-bc95-3591baf45f9d" index="0"></cpix:ContentKeyPeriod>
    </cpix:ContentKeyPeriodList>
    <cpix:ContentKeyUsageRuleList>
        <cpix:ContentKeyUsageRule kid="c798e6ea-0098-462a-830b-dbc21fbd9c5e" intendedTrackType="VIDEO">
            <cpix:KeyPeriodFilter periodId="keyPeriod_a2390064-8f91-42db-bc95-3591baf45f9d"></cpix:KeyPeriodFilter>
            <cpix:VideoFilter></cpix:VideoFilter>
        </cpix:ContentKeyUsageRule>
        <cpix:ContentKeyUsageRule kid="01e5a62d-a0ef-4bae-8773-7a51b2765109" intendedTrackType="AUDIO">
            <cpix:KeyPeriodFilter periodId="keyPeriod_a2390064-8f91-42db-bc95-3591baf45f9d"></cpix:KeyPeriodFilter>
            <cpix:AudioFilter></cpix:AudioFilter>
        </cpix:ContentKeyUsageRule>
    </cpix:ContentKeyUsageRuleList>
</cpix:CPIX>

3. AWS MediaConvert Config

Because AMC does not support injecting the Authorization header directly, an intermediary proxy is required to add the authentication header before forwarding requests to the Sigma DRM KMS; AWS API Gateway is recommended.

3.1. AWS API Gateway

Configure an HTTP API on AWS API Gateway to act as a reverse proxy that appends the Authorization header to each request.

Step 1: Create HTTP API
- Go to the AWS API Gateway Console.
- Choose Create API -> select HTTP API -> click Build.
- Under API name, enter SigmaDRM-SPEKE-Proxy.
Step 2: Configure Route & Integration
- Create route: POST /speke (or /{proxy+}).
- Add HTTP integration: Method POST, point Endpoint URL to the SPEKE Ingest API in Section 2.
Step 3: Parameter Mapping (Authorization Header)
- In API Gateway, navigate to Integrations -> select the route POST /speke.
- Under Parameter mapping, choose Manage parameter mapping.
- Add request header mapping:
Mapping Type Parameter Action Value
Request header Authorization Overwrite 'Basic {CredentialToken}'
- In where:
  - Value must be wrapped in single quotes: 'Basic ...'
  - CredentialToken: See instructions to create at How to authorization into Sigma MultiDRM system.
- Deploy the API and copy the Invoke URL:
text
```
https://{api-id}.execute-api.{region}.amazonaws.com/speke
```

Mapping Type	Parameter	Action	Value
Request header	Authorization	Overwrite	`'Basic {CredentialToken}'`

3.2. Configure AWS MediaConvert Job

Prerequisite: Ensure MediaConvert has an IAM Role with access to S3 (Input & Destination).

MediaConvert Job Settings:

Create a Job and select a valid IAM role.
In Output groups (CMAF / HLS / DASH), turn on Enable DRM encryption and choose Key provider as SPEKE.
Configure the parameters:

Parameter	Value	Description
Encryption method	`SAMPLE_AES`	Standard encryption method for CMAF/HLS
Initialization vector in manifest	`INCLUDE`	Embed IV into manifest/playlist for players
URL	`https://{api-id}.execute-api.{region}.amazonaws.com/speke`	API Gateway Invoke URL from Section 3.1
Resource ID	`{contentId}`	Unique identifier for the content
SPEKE version	`2.0`	SPEKE protocol version
HLS / DASH signaled system IDs	See table below	UUIDs of target DRM systems
Encryption contract configuration	Video Preset = `PRESET_VIDEO_1` Audio Preset = `PRESET_AUDIO_1`	Separate keys for Audio & Video (or `SHARED` for a single key)

Support DRM System:

DRM	SYSTEM ID	STREAMING FORMAT
Microsoft PlayReady	`9a04f079-9840-4286-ab92-e65be0885f95`	MPEG-DASH, CMAF, Microsoft Smooth Streaming
Google Widevine	`edef8ba9-79d6-4ace-a3c8-27dcd51d21ed`	MPEG-DASH, CMAF, HLS-fMP4
Apple FairPlay	`94ce86fb-07ff-4f43-adb8-93d2fa968ca2`	HLS-(sTS/fMP4), CMAF

Example MediaConvert Job JSON:

View MediaConvert Job JSON

json

{
  "Queue": "arn:aws:mediaconvert:us-east-1:442831590373:queues/Default",
  "UserMetadata": {},
  "Role": "arn:aws:iam::442831590373:role/MediaConvert_Default_Role",
  "Settings": {
    "TimecodeConfig": {
      "Source": "ZEROBASED"
    },
    "OutputGroups": [
      {
        "CustomName": "test",
        "Name": "CMAF",
        "Outputs": [
          {
            "ContainerSettings": {
              "Container": "CMFC"
            },
            "VideoDescription": {
              "CodecSettings": {
                "Codec": "H_264",
                "H264Settings": {
                  "MaxBitrate": 5000000,
                  "RateControlMode": "QVBR",
                  "SceneChangeDetect": "TRANSITION_DETECTION"
                }
              }
            },
            "NameModifier": "v"
          },
          {
            "ContainerSettings": {
              "Container": "CMFC"
            },
            "AudioDescriptions": [
              {
                "CodecSettings": {
                  "Codec": "AAC",
                  "AacSettings": {
                    "Bitrate": 96000,
                    "CodingMode": "CODING_MODE_2_0",
                    "SampleRate": 48000
                  }
                }
              }
            ],
            "NameModifier": "a"
          }
        ],
        "OutputGroupSettings": {
          "Type": "CMAF_GROUP_SETTINGS",
          "CmafGroupSettings": {
            "SegmentLength": 10,
            "Destination": "s3://drm-speke-test2/",
            "DestinationSettings": {
              "S3Settings": {
                "StorageClass": "STANDARD"
              }
            },
            "Encryption": {
              "EncryptionMethod": "SAMPLE_AES",
              "InitializationVectorInManifest": "INCLUDE",
              "SpekeKeyProvider": {
                "ResourceId": "mediaconvert_1",
                "HlsSignaledSystemIds": [
                  "edef8ba9-79d6-4ace-a3c8-27dcd51d21ed"
                ],
                "DashSignaledSystemIds": [
                  "edef8ba9-79d6-4ace-a3c8-27dcd51d21ed"
                ],
                "Url": "https://api-dev.sigmadrm.com/assets/ingest/speke/16aa76cb-8aa0-4a19-82b6-436493bc6215/e9fa8110-a795-40e9-9f72-a46c625f4a51",
                "EncryptionContractConfiguration": {
                  "SpekeVideoPreset": "PRESET_VIDEO_1",
                  "SpekeAudioPreset": "PRESET_AUDIO_1"
                }
              },
              "Type": "SPEKE"
            },
            "FragmentLength": 2
          }
        }
      }
    ],
    "FollowSource": 1,
    "Inputs": [
      {
        "AudioSelectors": {
          "Audio Selector 1": {
            "DefaultSelection": "DEFAULT"
          }
        },
        "VideoSelector": {},
        "TimecodeSource": "ZEROBASED",
        "FileInput": "s3://forensic-watermark-test/input.mp4"
      }
    ]
  },
  "BillingTagsSource": "JOB",
  "AccelerationSettings": {
    "Mode": "DISABLED"
  },
  "StatusUpdateInterval": "SECONDS_60",
  "Priority": 0
}

CHANGE LOG

02/10/2026: Init document AWS Elemental MediaConvert with SPEKE 2.0 and API Gateway

How to integrate AWS Elemental MediaConvert using SPEKE ​

1. Introduction ​

2. SPEKE Ingest API ​

3. AWS MediaConvert Config ​

3.1. AWS API Gateway ​

3.2. Configure AWS MediaConvert Job ​

CHANGE LOG ​