Ensure that the signing key is the same as the key specified in the token restriction

Question

Hi,

I'm using DRM Widevine for my Content Key Policy. I'm having an issue on how do I implement the token to be generated by my nodejs backend to be consumed by my player.

Here is the sample of my error
https://dev-qa-environment.s3.ap-southeast-1.amazonaws.com/media-service/azureplayer.html

When calling the widevine from the player, I get:

Failed content key policy evaluation. Additional information: ↵Policy option 3568952f-b764-4823-b66d-fb06cdcc3629: Token signature verification failed. Ensure that the signing key is the same as the key specified in the token restriction.

Here's my current implementation:
Client page loads -> Asks for token in the backend (NodeJS) -> Backend will connect to azure -> Backend to generate a jwt using issuer, audience and signature (PrimaryVerificationKey from my widevine token restriction) -> Backend sends back to client page the generated token -> client page will use the token as bearer for the widevine license url

Thank you in advance

Answer 1

Hi @Francis Valbuena ,

Your policy could be failing for any of the following reasons:

• Missing authentication header.
• Bad authentication header value.
• The token has expired.
• The token contains an invalid signature.
• Policy misconfiguration

Check your jwt token to ensure the values are configured correct.