Hi, I submitted a FairPlay Streaming credentials approval request 5 days ago (through the "Request FairPlay Streaming credentials approval" form) and haven't received any response yet. Could someone from the Security Engineering team please check the status? Team ID: US7RGQX775 We're an online education platform and use a third-party DRM/video hosting provider (VdoCipher) that already operates a working, tested FairPlay Streaming KSM on our behalf — we just need the certificate to hand over to them. Thanks in advance!

I implemented an AVContentKeySessionDelegate that after calling processContentKeyRequest succeeds in producing a contentKey in the callback func contentKeySession(_: AVContentKeySession, didProvide _contentKey: AVContentKey) of the AVContentKeyRecipient that manages the decoding of CMSampleBuffers. However, when I store the AVContentKey from the contentKeySession callback and try to attach it to the CMSampleBuffer with AVSampleBufferAttachContentKey, I get the error: Error Domain=AVFoundationErrorDomain Code=-11836 "Cannot Open" UserInfo={NSLocalizedFailureReason=This app is not authorized to play this file., NSLocalizedDescription=Cannot Open, NSUnderlyingError=0x28303a220 {Error Domain=NSOSStatusErrorDomain Code=-12161 "(null)"}} Does anyone have some insight on why this is happening and how to solve it?

Currently we are building a service based on Fairplay SDK version 26.0. Currently our solution is using version 4.5.4. When we run the below request to get version we get proper response curl http://xx.xx.xx.xx:8080/fps/v Response - V26.0 Our client applications call below two APIs https://GW_HOST:8080/fairplay_cert https://GW_HOST:8080/fairplay_license Within the cert API call, we are returning the fairplay public certificate. Currently we are trying to use the test certificate provided along with Fairplay SDK (test_fps_certificate_v26.bin) Then within the fairplay_license API call, we are trying to reach fairplay service based on Fairplay SDK v26 We are seeing some issues with below request(attaching the request json payload) curl -v -X POST -H "Content-Type: application/json" -d @SDKValidation_NewCert.json http://xx.xx.xx.xx:8080/fps SDKValidation_NewCert.json We are getting below response from SDK {"fairplay-streaming-response":{"create-ckc":[{"id":1,"status":-42605}]}} When we checked the apache error logs in the file "/etc/httpd/logs/error_log" we see below error [DEBUG] ❌ Assertion failure: invalidCertificateErr (-42605) [src/extension.swift:249] This is looks to be some error related to certificate. As mentioned earlier, client application is making a certificate call where we are returning the certificate set up . These certificates are already configured in the credentials path. Also note that the test samples provided with the SDK return valid license response. We had earlier raised a similar ticket mentioned below and we were asked not to use test certs. So we have raise CSR and used new certs for testing. https://developer.apple.com/forums/thread/836652?page=1

Due to hysterical raisins, our Apple Developer Account (2A...FW) has five FairPlay Streaming resources under https://developer.apple.com/account/resources/certificates/list Three of these are certificates (fairplay.cer) and two of them are provisioning packages (fps-bundle.zip). The three certificates all use 1024-bit RSA keys and have creation dates of: Oct 24 23:22:09 2016 (expired Oct 25 23:22:09 2018) 3J Mar 29 19:39:15 2018 (expired Mar 29 19:39:15 2020) 2N Feb 11 00:32:06 2026 (expires Feb 1 00:22:57 2027) LD (I've included the first two characters of the Apple resource ID to help keep these straight.) The key for the first two (same key for both) is lost to the mists of time. The third is a cert I created from a new key, so I have the key for it. (The developer portal will not let us create any more 1024-bit FairPlay certs.) The two FPS bundles each contain an fps_certificate.bin which itself contains a 1024-bit cert and a 2048-bit cert. Looking at this file in each bundle, the bundles include the same 1024-bit cert that I created on Feb 11, but two different 2048-bit certs with creation dates of: Feb 11 00:32:06 2026 (expires Feb 11 00:32:05 2028) YP Feb 11 00:56:22 2026 (expires Feb 11 00:56:21 2028) 9N Both 2048-bit certs use the same key (which I have). Finally, we use a third-party as our streaming provider. With them we shared the first FPS bundle (YP). So, this is a big mess. And I'm unable to delete any of these entries from our developer account. Questions: Does the expiration date on these certs matter or is it ignored for streaming purposes? How do we delete FP certs/bundles we no longer need/use/are expired? With respect to using third-party vendors for streaming (with whom we've shared an FPS bundle): Is it okay to re-use the same FPS bundle if we change vendors? Should we ask Apple to delete an FPS bundle once we stop using a vendor?

Currently we are building a service based on Fairplay SDK version 26.0. Currently our solution is using version 4.5.4. When we run the below request to get version we get proper response curl http://xx.xx.xx.xx:8080/fps/v Response - V26.0 Our client applications call below two APIs https://GW_HOST:8080/fairplay_cert https://GW_HOST:8080/fairplay_license Within the cert API call, we are returning the fairplay public certificate. Currently we are trying to use the test certificate provided along with Fairplay SDK (test_fps_certificate_v26.bin) Then within the fairplay_license API call, we are trying to reach fairplay service based on Fairplay SDK v26 We are seeing some issues with below request(attaching the request json payload) curl -v -X POST \ -H "Content-Type: application/json" \ -d @SDKValidation.json \ http://xx.xx.xx.xx:8080/fps SDKValidation.json We are getting below response from SDK {"fairplay-streaming-response":{"create-ckc":[{"id":1,"status":-42605}]}} When we checked the apache error logs in the file "/etc/httpd/logs/error_log" we see below error [DEBUG] ❌ Assertion failure: invalidCertificateErr (-42605) [src/extension.swift:249] This is looks to be some error related to certificate. As mentioned earlier, client application is making a certificate call where we are returning the test certificates provided along with the SDK (test_fps_certificate_v26.bin). These certificates are already configured in the credentials path. Also note that the test samples provided with the SDK return valid license response.

Hello, I have a problem generating a 2048-bit FairPlay Streaming certificate. I tried generating SDK v26.x certificate in two ways. (1) Use existing certificate (2) Create new certificate Though, in both ways, Apple gives me a certificate bundle of 1024-bit certificate. (fps_certificate.bin) I've uploaded 2048-bit CSR on creating a certificate. Just to note, I have created a SDK v4.x certificate few years ago. Have anyone bumped into a same issue? Or am I missing something?

Currently we are building a service based on Fairplay SDK version 26.0. Currently our solution is using version 4.5.4. When we run the below request to get version we get proper response curl http://xx.xx.xx.xx:8080/fps/v Response - V26.0 Our client applications call below two APIs https://GW_HOST:8080/fairplay_cert https://GW_HOST:8080/fairplay_license Within the cert API call, we are returning the fairplay public certificate. Currently we are trying to use the test certificate provided along with Fairplay SDK (test_fps_certificate_v26.bin) Then within the fairplay_license API call, we are trying to reach fairplay service based on Fairplay SDK v26 We are seeing some issues with below request(attaching the request json payload) curl -v -X POST \ -H "Content-Type: application/json" \ -d @SDKValidation.json \ http://xx.xx.xx.xx:8080/fps SDKValidation.json We are getting "Empty response from server" When we checked the apache error logs in the file "/etc/httpd/logs/error_log" we see some exception. We are sharing the traces in a file (ApacheErrorLogs.txt). ApacheErrorLogs.txt Also if we use old pblic key used with version 4.5.4, we are getting another error from service. {"fairplay-streaming-response":{"create-ckc":[{"id":1,"status":-42605}]}} Can you please help us with the reason of this failure?

Hi everyone, I am working on an app that supports offline playback with FairPlay Streaming (FPS). I have successfully implemented the logic to download and persist the content keys (TLLV), and offline playback is working correctly using the stored persistent keys. However, I am now trying to implement a manual renewal process for these licenses, and I’ve run into an issue where the delegate methods are not being fired as expected. The Issue: I am calling contentKeySession.addContentKeyRecipient(asset) to force a renewal or re-fetch of the content key for a specific asset. Even though the asset is correctly initialized and the session is active, the AVContentKeySessionDelegate methods (specifically contentKeySession(_:didProvide:)) are not being triggered at all. My Questions: Why is the delegate not firing when adding the recipient? Is there a specific state or property the AVURLAsset needs to have (or a specific way it should be initialized) to trigger a new key request via addContentKeyRecipient? Is it possible to perform a manual license renewal triggered by a UI action (e.g., a button tap) without actually initiating playback of the asset? The goal is to allow users to refresh their licenses manually while online, ensuring the content remains playable offline before the previous license expires, all without forcing the user to start the video. Any insights or best practices for this manual renewal flow would be greatly appreciated.

Hi, I’ve identified a discrepancy between the FairPlay Streaming SPC v3 documentation and the provided Swift reference implementation regarding the SPC payload length field. Documentation states: The SPC V3 structure defines: SPC payload length: 4 bytes However, in Apple’s Swift sample implementation: // Move local offset by 12 to adjust for padding localOffset += 12 spcContainer.spcDataSize = Int(try readBigEndianU32(spc, localOffset)) This indicates: A 16-byte field (12 bytes padding + 4-byte length) This behavior also matches the SPC sample provided in the FairPlay Streaming SDK (sample_spc_v3.b64 ). 00000003 // spc version 00000000 // reserved .... 00000000000000000000000000000f40 // spc payload length (16 bytes) Could you please confirm the correct implementation? Thanks

Hi, I received an SPC without a device Identity TLLV and with an invalid (i.e a value that is not specified in the FairPlay programming guide) value of device type in the Device info TLLV. The info I got is the following - Apple Device Type: Type:0x555ea482e2ef0a7c, OS version:189.121.178 Does anyone know what device type it is, and why it does not conform to the Apple spec? Also, should I accept such an SPC or is it not valid? Thanks.

We are developing a video streaming app that uses AVContentKeySession with FairPlay Streaming. Our implementation supports both online playback (non-persistable keys) and offline playback (persistable keys). We have observed the following behavior: Once a content key has been obtained for a given Content Key ID, AVContentKeySession does not trigger contentKeySession(_:didProvide:) again for that same Key ID We also attempted to explicitly call processContentKeyRequest(withIdentifier:initializationData:options:) on the session to force a new key request for the same identifier, but this did not result in the delegate callback being fired again. The session appears to consider the key already resolved and silently ignores the request. This means that if a user first plays content online (receiving a non-persistable key), and later wants to download the same content for offline use (requiring a persistable key), the delegate callback is not fired again, and we have no opportunity to request a persistable key. Questions Is this the expected behavior? Specifically, is it by design that AVContentKeySession caches the key for a given Key ID and does not re-request it — even when processContentKeyRequest(withIdentifier:) is explicitly called? Should we use distinct Content Key IDs for persistable vs. non-persistable keys? For example, if the same piece of content can be played both online and offline, is the recommended approach to have the server provide different EXT-X-KEY URIs (and thus different key identifiers) for the streaming and download variants? Is there a supported way to force a fresh key request for a Key ID that has already been resolved — for example, to upgrade from a non-persistable to a persistable key? Environment iOS 18+ AVContentKeySession(keySystem: .fairPlayStreaming) Any guidance on the recommended approach for supporting both streaming and offline playback for the same content would be greatly appreciated.

Hi, Has anyone been able to protect the audio part of FairPlay protected content from being captured as part of screen recording on Safari/iOS (PWA and/or online web app)? We have tried many things but could not prevent the audio from being recorded. Same app and content on Safari/Mac does not allow audio to be recorded. Any tips?

Hi, Our client currently has an FPS deployment certificate generated with SDK version 4 that is still actively used in production. They would like to generate an additional certificate using SDK version 26. Before doing so, they just want to confirm: Will the existing SDK 4 certificate remain unaffected and still visible in the Apple Developer portal? Any considerations they should keep in mind? Thanks! :)

Hi, Our client currently has an FPS deployment certificate generated with SDK version 4 that is still actively used in production. They would like to generate an additional certificate using SDK version 26. Before doing so, they just want to confirm: Will the existing SDK 4 certificate remain unaffected and still visible in the Apple Developer portal? Any considerations they should keep in mind? Thanks!

We have implemented offline Fairplay playback and it works fine.But at times when trying to playback the offline downloaded content, we get the following error"An unknown error occured (-42650)"Tried looking up the error in the documentation but couldnt find anything relevant.What could possibly be creating this error?

We're sending the spcData payload to our fairplay key server (version 5.1) with the base64 encoded string of our fairPlay.cer that was downloaded from our developer portal and we're getting a spcVersionErr (-42580) for the spc version. The value that is being received by the key server seems to be 813827283 when it should be either 1 (base_constants.SPCVersion.v1.rawValue) or 2 (base_constant.SPCVersion.v2.rawValue). We're assuming we're encoding the fairplay.cer incorrectly. Any insight from anybody would be appreciated.

I am working on offline license support for FairPlay. I am trying to identify offline vs. live streaming requests. How do I do that? Is there any way to identify the request type (offline or streaming) from SPC?

Hello, I’m using a valid certificate bundle generated with SDK 26 (combined RSA‑1024 + RSA‑2048). However, all my devices currently still generate SPC v2 during playback, including my iPhone 16 under iOS 26.2. Apple staff mentioned that future iOS versions will send SPC v3 when using an SDK 26 certificate bundle. Could you please clarify: Which iOS/macOS versions will first support SPC v3? Are there any additional client‑side requirements (Safari version, playback APIs, headers, etc.) to trigger SPC v3? Is there any way to test SPC v3 today, e.g., using beta builds? Thank you!

Hello,We have been working on FPS for a while and managed to play an encrypted asset with it, using version 2 of FairPlay Streaming Server SDK 2.03.Now we are working on "Download and Play Offline" functionality. For this I have downloaded the FairPlay Streaming Server SDK 3.0 and in SDK Folder there is "OfflineHLSGuide_withFPS.pdf" document beside "FairPlayStreaming_PG.pdf" where they tell about how it works and what need to be done.In that document ("OfflineHLSGuide_withFPS.pdf") there is new version of Content Key Duration TLLV which is slightly different than the structure shown in "FairPlayStreaming_PG.pdf"For Content Key Duration TLLV (0x47acf6a418cd091a) in "FairPlayStreaming_PG" there is "Lease Duration" between bytes 16-19.But in the document about OfflineHLSGuide, it says "Reserved" for bytes between 16-19.Where has LeaseDuration gone for offline? ORShould I use one ContentKeyDuration TLLV for non-persist and other version of ContentKeyDuration TLLV for (persist)offline?Thanks

Hello, I am reviewing the sample codes of FairPlay Streaming SDK 26 and there was a place where I think is a mistake. The codes are for the server, for both Swift and Rust codes. There is an if statement which compares "ProtocolVersionUsed"(spcData.versionUsed) and SPCVersion1 constant, though "ProtocolVersionUsed" and SPC Version is a different thing, so shouldn't it be using a different constant value? [createContentKeyPayload.swift] // Fallback to version 1 if content can have encrypted slice headers, which need to be decrypted separately. Slice headers are not encrypted when using CBCS. if serverCtx.spcContainer.spcData.versionUsed == base_constants.SPCVersion.v1.rawValue && [createContentKeyPayload.rs] // Fallback to version 1 if content can have encrypted slice headers, which need to be decrypted separately. Slice headers are not encrypted when using CBCS. if (serverCtx.spcContainer.spcData.versionUsed == SPCVersion::v1 as u32) && Thank you.