📜 Changelog
Every user-visible improvement to CDMPOOL, most recent first. Backend refactors and infra work are omitted — see the roadmap for what's next.
v3.1 Aug 2026
- SECURITYAnti-fraud protection & multi-account detection updated. Our anti-fraud and multi-account detection systems have been upgraded to prevent abuse of the service.
v3.0 Jul 2026
- NEWClearKey support. CDMPOOL now extracts ClearKey keys in addition to Widevine and PlayReady — pick
ClearKeyin the DRM selector on /extract (or send"drm":"clearkey"to/api/extract). No CDM / no device download required: ClearKey keys are returned in the clear by the license server, so extraction is instant. - NEWSmart ClearKey challenge builder. CDMPOOL reads the ClearKey / W3C-common PSSH (SystemID
1077efec…/e2719d58…), then tries a service-specific embedded challenge (e.g. DMM.co.jp) first and falls back to the standard EME request{"kids":[…],"type":"temporary"}. The JWK Set response is parsed straight intoKID:KEYhex pairs. - FIXClearKey PSSH mis-selection guard. If you paste a ClearKey PSSH but leave the DRM set to Widevine/PlayReady, CDMPOOL no longer wastes a CDM request — it returns
E_CLEARKEY_PSSHand tells you to switch to the ClearKey mode.
v2.8.9 Jul 2026
- KITDisney+ / Star+ / Hulu extractor kit — new zero-install Python script on /downloads. Paste a "Copy as cURL" from your browser DevTools + the manifest URL, the kit does the rest (challenge → license → decrypt → MP4). Auto-downloads N_m3u8DL-RE, mp4decrypt and ffmpeg on first run.
- NEWDisney+ / BAMGrid finally works. The default SmartTV PlayReady device was revoked by Disney a while back — CDMPOOL now maintains a pool of 13 SL3000 devices and rotates through them automatically until one is accepted. First success takes ~500 ms; every subsequent request to the same service skips the loop entirely.
- NEWAutomatic CDM prioritization per service. When a specific WVD/PRD wins for a given license host, CDMPOOL remembers it and uses it first next time — cutting time-to-first-key from seconds to milliseconds. Works for both Widevine (16 fresh Android L1 devices in the pool) and PlayReady (13 SL3000 devices).
- FIXWidevine rotation for revocation errors. When a license server responds with
ACCESS_DENIED/device_not_authorized/hdcp_required/revoked cdm, we now transparently rotate through the WVD pool instead of giving up. - PERFMPD analyzer accepts session auth.
/api/mpd-analyzenow accepts optionalheadersandcookies— the Disney+, Amazon Prime and Netflix session-locked manifests can be parsed server-side. - NEW
--psshflag on the Disney+ kit lets you skip the MPD analyzer entirely (useful for HLS streams and situations where the manifest is behind extra auth).
v2.8.8 Jul 2026
- NEWHomepage banner is now compact, centered and mobile-friendly — no more push-down on small screens.
- NEWOnlyFans zero-install kit v2 — the kit downloads its own N_m3u8DL-RE / mp4decrypt / ffmpeg binaries on first run. Only Python 3.8+ needed. Windows / macOS / Linux, x64 or arm64. Handles a single post, a full URL or a creator's entire timeline.
- NEWMPD analyzer with suggestion chips in the /extract UI. Paste a manifest URL, the analyzer extracts PSSH (Widevine + PlayReady), KID, DRM provider, resolutions and a license-URL template — you click chips to fill fields instead of typing.
- FIXChrome DevTools "…" truncation detector. When you Copy-as-cURL from DevTools, Chrome sometimes truncates long values with a U+2026 ellipsis. Instead of a cryptic HTTP 500, CDMPOOL now returns
E_HEADER_CONTAINS_TRUNCATIONwith the culprit header name and the exact fix. - PERFAI diagnosis is now deterministic + cached. Same failure signature = same hint. No more "why does the hint change every time I refresh?".
- FIXAI diagnosis stopped saying "you're IP-bound". The old prompt was hallucinating IP-locking on services that don't do it (OnlyFans, EZDRM, most Widevine flows). The prompt was rewritten and every dirty hint was purged and re-generated.
v2.8.0 – v2.8.7 Feb 2026
- NEW"Copy as cURL" import on POST /api/extract and the /extract form. Paste any DevTools Network cURL (bash, cmd.exe or PowerShell) — we auto-parse the URL and all headers, silently strip hop-by-hop noise (Content-Length, Host, Accept-Encoding, ":authority", etc.) and pass the rest to the license server. Eliminates ~40% of user-error failures.
- NEWAmazon Prime Live TV kit (EU / NA / FE region). Turn-key extractor that logs into Amazon, enumerates channels and pushes each successful extraction into /me.
- NEWChrome extension pack — Chrome CDM Decryptor pre-configured with your CDMPOOL token. Harvests keys from any DRM tab you visit.
- FIXEZDRM ?PX= case-sensitivity. Fixed iteration_16 LOW regression.
- NEW7 new preflight error codes catching the top misconfigurations before consuming a CDM session:
E_LICENSE_IS_MANIFEST,E_LICENSE_IS_PAGE,E_EZDRM_PROFILE_REQUIRED,E_EXPRESSPLAY_TOKEN_REQUIRED,E_BUYDRM_CUSTOMDATA_REQUIRED,E_PALLYCON_WRONG_ENDPOINT,E_PALLYCON_CUSTOMDATA_REQUIRED. - NEWDRMToday + Kinescope preflight adapters.
v2.5 Feb 2026
- FIXcmd.exe shell-escape auto-unescape —
^&,^%,^"in Windows cURL exports no longer break URL parsing. - FIXHop-by-hop header strip — Content-Length / Host / Connection / Accept-Encoding from browser cURL exports were the #1 hidden cause of Cloudflare/CloudFront 400s and 403s on Vimeo / Amazon / PallyCon. Now silently removed.
- FIXAmazon Prime "Invalid" diagnostic — clearer message when Amazon rejects a stale sessionHandoffToken.
v2.3 Feb 2026
- NEWSupport ticket system — chat directly with the admin from /me/tickets, link failed attempts to a ticket, get replies in real time.
- NEWOne-shot API
POST /api/extract— a single call that runs challenge + license request + get-keys and returns KID:KEY. Full docs. - NEWActionable error codes — 30+ distinct codes with a plain-English hint on every failed extraction (
E_PSSH_WRONG_SYSTEM_ID,E_LICENSE_UNAUTHORIZED,E_LICENSE_GEO_BLOCKED, …). - NEWWidevine → PlayReady auto-retry. If a service rejects our generic Widevine L3 CDM (Amazon Prime, Netflix SmartTV, Max, Disney+ TV), we now automatically retry with PlayReady using the PSSH from the same manifest.
- PERFExtraction attempts library — every attempt (successful or not) is logged with PSSH, license URL, headers and full error body. See /me for your own history.
- FIXAPIMAIN 500s during session churn — pywidevine's 16-session pool was leaking on failed GetKeys. Now auto-reaps stale sessions before every open + a health-check cron auto-restarts APIMAIN if it repeatedly hits 500.
v2.0 Nov 2025
- NEWRebrand to CDMPOOL, English site, docs.
- NEWMulti-user auth, per-member API tokens, IP quota, registration throttle.
- NEWHTTPS (Let's Encrypt), CSP + COOP/CORP + HSTS 2y, secure cookies (HttpOnly + Secure + SameSite=Lax + 8h).
- NEWNOWPayments crypto → VIP auto-upgrade (150 USD/year).
- NEWFull mobile-responsive UI.
Something missing you'd like to see? Open a support ticket — every request is read.