0. Which endpoint should I use?

CDMPOOL exposes two different flows for extracting DRM keys. Choosing the wrong one is the #1 source of failed extractions. Read this before doing anything else.

0. Manifest analyzer — POST /api/mpd-analyze

Powers the "🔍 Analyze" button on the Extract UI — but you can also hit it directly from your own tooling. The Extract UI displays each returned field as a chip that the user can click to fill the corresponding form input; existing values are never overwritten silently.

curl -X POST https://cdmpool.xyz/api/mpd-analyze \
  -H "Content-Type: application/json" \
  -d '{"mpd_url":"https://storage.googleapis.com/shaka-demo-assets/angel-one-widevine/dash.mpd"}'

Successful response (ok:true):

{
  "ok": true,
  "manifest_type": "dash",           // "dash" | "hls" | "unknown"
  "drm":           "widevine",       // best guess (widevine has priority)
  "pssh":          "AAAAPnBz...",    // convenience default (widevine if any)
  "pssh_widevine": "AAAAPnBz...",
  "pssh_playready":null,
  "kid":           "800aacaa-5229-58ae-8880-62b5695db6bf",
  "license_url":   null,             // filled when the PR PSSH carries a LA_URL
                                     //   OR when the provider is recognised
  "drm_provider":  null,             // ezdrm|axinom|pallycon|kinescope|amazon|…
  "resolutions":   ["192x144","320x240","480x360","640x480","768x576"]
}

Failure response (ok:false) — never raises, always JSON:

{
  "ok":           false,
  "fetch_status": 403,
  "hint":         "The CDN refused our request (HTTP 403). This usually
                   means the MPD is behind auth (signed cookies, session,
                   IP-lock). Try our platform-specific kits from /downloads."
}

What we can auto-detect

• ✅ Public MPDs (Bitmovin, Shaka, Axinom test vectors, EZDRM, Kinescope, DRMToday public) → all fields filled
• ✅ PlayReady MPDs → we decode the WRMHEADER XML embedded in the PSSH box and extract the exact <LA_URL>
• ⚠️ Auth-protected MPDs (DAZN, Molotov, Axinom production) → we can still fetch the PSSH if the URL is anonymously reachable, but you'll need to fill license_url + auth headers yourself

1. One-shot API — POST /api/extract

CDMPOOL does GetChallenge, calls the license server, unwraps JSON envelopes when needed, and returns the derived keys — all in a single round-trip.

curl -X POST https://cdmpool.xyz/api/extract \
  -H "Content-Type: application/json" \
  -d '{
    "token":       "<your_api_token>",
    "drm":         "widevine",
    "pssh":        "AAAA... (base64 from <cenc:pssh>)",
    "license_url": "https://example.com/license",
    "headers":     {"Authorization":"Bearer …", "X-Custom":"…"},
    "cookies":     {"session":"…"},
    "channel_name":"Optional label",
    "mpd_url":     "https://.../manifest.mpd"
  }'

Success (HTTP 200):

{
  "ok":         true,
  "keys":       [{"kid":"…","key":"…"}, ...],
  "ms":         340,
  "session_id": "…"
}

On success, CDMPOOL also silently stores the extraction under /me/extractions together with an xaccel_url (mpd_url + ?decryption_key=KID:KEY) that plays directly in VLC / IPTV Smarters. That ready-to-play URL is not returned in the API body — read it from the extractions library.

Failure (HTTP 4xx/5xx):

{
  "ok": false,
  "step": "license_request",
  "status": 403,
  "error_code": "E_LICENSE_FORBIDDEN",
  "hint": "License server returned 403 Forbidden. Likely missing auth
           header, missing Origin/Referer, or expired session."
}

Fields headers, cookies, channel_name, mpd_url, source_url, country, note are optional. Only token, drm, pssh and license_url are required.

"auto_retry": {
  "attempted": true,
  "from_drm":  "widevine",
  "to_drm":    "playready",
  "ok":        true,
  "pssh_source": "mpd"
}

cURL — parse keys with jq

curl -s -X POST https://cdmpool.xyz/api/extract \
  -H 'Content-Type: application/json' \
  -d '{
    "token":       "YOUR_TOKEN",
    "drm":         "widevine",
    "pssh":        "AAAAW3Bzc2g...",
    "license_url": "https://cwip-shaka-proxy.appspot.com/no_auth"
  }' | jq -r '.keys[] | "--key \(.kid):\(.key)"'
# → --key 62e6b3fd5b6c4c9c9f22a1e5f9a7d820:8f2b1e...

Python example

import requests

r = requests.post("https://cdmpool.xyz/api/extract", json={
    "token":       "YOUR_TOKEN",
    "drm":         "widevine",
    "pssh":        "AAAAW3Bzc2g...",
    "license_url": "https://cwip-shaka-proxy.appspot.com/no_auth",
})
d = r.json()
if d["ok"]:
    for k in d["keys"]:
        print(f"--key {k['kid']}:{k['key']}")
else:
    print(f"[{d['error_code']}] {d['hint']}")

Node.js example

const r = await fetch("https://cdmpool.xyz/api/extract", {
  method: "POST",
  headers: {"Content-Type": "application/json"},
  body: JSON.stringify({
    token:       "YOUR_TOKEN",
    drm:         "widevine",
    pssh:        "AAAAW3Bzc2g...",
    license_url: "https://cwip-shaka-proxy.appspot.com/no_auth",
    headers:     {"X-AxDRM-Message": "eyJ..."}   // optional per-service auth
  })
}).then(r => r.json());

if (r.ok) {
  for (const k of r.keys) console.log(`--key ${k.kid}:${k.key}`);
} else {
  console.error(`[${r.error_code}] ${r.hint}`);
}

2. Quick start & token info

Every request needs your personal API token. Find it in My account after signing in. Each successful extraction consumes 1 unit from your daily quota (5/day on Free, unlimited on VIP).

Pass the token in the JSON body as "token" for /api/extract, or as the api-key header for /extension. Select the DRM system per call with "drm": "widevine" or "drm": "playready".

3. Amazon Prime Video — full pipeline example

Good news! As of Feb 2026 CDMPOOL supports Amazon Prime end-to-end via a single POST /api/extract call — we auto-detect atv-ps.primevideo.com / atv-ps.amazon.com URLs and:

• use curl_cffi with a chrome120 TLS fingerprint (Amazon rejects plain python-requests);
• form-encode the challenge as playReadyChallenge (or licenseChallenge for Widevine session-handoff);
• unwrap the JSON envelope (playReadyLicense.encodedLicenseResponse) automatically.

Important: Amazon rotates the KID on every MPD fetch. You must capture the PSSH from a fresh manifest and submit within the same session, otherwise you will get PRS.InvalidRequest.

Recommended flow — PlayReady, one shot (works from any IP):

import requests
from curl_cffi import requests as cffi   # pip install curl_cffi

ASIN         = "amzn1.dv.gti.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
MARKETPLACE  = "A3K6Y4MI8GDYMT"           # EU. NA=ATVPDKIKX0DER
DEVICE_ID    = "fdd8c346-7883-430a-9fc3-dcdf4bf4df74"
COOKIES      = {                          # export from your browser (Netscape or dict)
    "at-main-av":  "Atza|...",           #   auth token
    "ubid-main-av":"131-...",             #   session id
    "session-id":  "143-...",
    "session-token":"...",
}

# 1) Ask Amazon for the current playback URL & manifest
qs = {
    "deviceID": DEVICE_ID, "deviceTypeID": "AOAGZA014O5RE",
    "firmware": "1", "gascEnabled": "false", "marketplaceID": MARKETPLACE,
    "playerType": "xp", "operatingSystemName": "Windows",
    "operatingSystemVersion": "10.0", "deviceApplicationName": "EdgeNext",
    "asin": ASIN, "consumptionType": "Streaming",
    "desiredResources": "PlaybackUrls", "resourceUsage": "CacheResources",
    "videoMaterialType": "Feature", "displayWidth": "2560", "displayHeight": "1440",
    "deviceStreamingTechnologyOverride": "DASH", "deviceDrmOverride": "CENC",
}
base = "https://atv-ps.primevideo.com/cdp/catalog/GetPlaybackResources"
r = cffi.get(base, params=qs, cookies=COOKIES, impersonate="chrome120")
url_set = r.json()["playbackUrls"]["urlSets"]
mpd_url = url_set[next(iter(url_set))]["urls"]["manifest"]["url"]

# 2) Fetch MPD, extract the current PlayReady PSSH
import re
mpd = cffi.get(mpd_url, cookies=COOKIES, impersonate="chrome120").text
pssh = re.search(
    r'<ContentProtection[^>]*schemeIdUri="urn:uuid:9a04f079-9840-4286-ab92-e65be0885f95"[^>]*>'
    r'.*?<cenc:pssh[^>]*>([^<]+)</cenc:pssh>',
    mpd, re.DOTALL | re.IGNORECASE).group(1).strip()

# 3) Send everything to CDMPOOL — one call, one response with the keys
qs_lic = {**qs, "desiredResources": "PlayReadyLicense",
          "resourceUsage": "ImmediateConsumption"}
license_url = base + "?" + "&".join(f"{k}={v}" for k, v in qs_lic.items())

result = requests.post("https://cdmpool.xyz/api/extract", json={
    "token":         YOUR_CDMPOOL_TOKEN,
    "drm":           "playready",
    "pssh":          pssh,
    "license_url":   license_url,
    "headers":       {},          # nothing extra required
    "cookies":       COOKIES,     # <-- CDMPOOL passes them to Amazon for you
    "channel_name":  "Prime Video CA — my extraction",
}).json()

print(result["keys"])   # [{"kid": "...", "key": "..."}]

The full runnable version (with cookie loader, ASIN discovery and offline Widevine fallback) is in the Amazon Prime Video kit. Widevine still requires an L1 CDM which CDMPOOL does not currently host — prefer PlayReady for Amazon Prime.

4. Chrome Extension — POST /extension

Endpoint reference:

POST https://cdmpool.xyz/extension
Header:  api-key: <YOUR_API_TOKEN>
Content-Type: application/json

Body:
{
  "init_data":        "<PSSH base64>",
  "license_request":  "<optional>",
  "license_response": "<base64 license response>"
}

Response:
{ "message": "success", "keys": "--key KID:KEY\n--key KID:KEY" }

Extension setup — edit license.json inside the extension folder:

{
  "api_url": "https://cdmpool.xyz/extension",
  "api_key": "<YOUR_API_TOKEN>"
}

5. Recipe: Brightcove-brokered streams (Télé-Québec, TSN, MLB…)

Brightcove exposes a public policy key that lets the license request succeed without cookies. Perfect for a one-shot /api/extract call:

import re, requests

CDMPOOL, TOKEN = "https://cdmpool.xyz", "<YOUR_API_TOKEN>"
PAGE = "https://telequebec.tv/regarder/en-direct/jeunesse"

# 1) Discover Brightcove account/player/media IDs from the public page
html = requests.get(PAGE).text
acc  = re.search(r'brightcoveAccountId\\?"[,:\\"]*([0-9]+)', html).group(1)
pid  = re.search(r'brightcovePlayerId\\?"[,:\\"]*([A-Za-z0-9]+)', html).group(1)
med  = re.search(r'brightcoveMediaId\\?"[,:\\"]*([0-9]+)', html).group(1)

# 2) Grab the policy key baked in the Brightcove player JS
js   = requests.get(f"https://players.brightcove.net/{acc}/{pid}_default/index.min.js").text
pk   = re.search(r'BCpkAD[A-Za-z0-9._-]{40,}', js).group(0)

# 3) Ask Brightcove for the playback info (returns MPD + license URL)
pb   = requests.get(
    f"https://edge.api.brightcove.com/playback/v1/accounts/{acc}/videos/{med}",
    headers={"Accept": f"application/json;pk={pk}"},
).json()
src  = next(s for s in pb["sources"] if s["src"].endswith(".mpd")
                                     and "com.widevine.alpha" in s.get("key_systems", {}))
mpd_url = src["src"]
lic_url = src["key_systems"]["com.widevine.alpha"]["license_url"]

# 4) Extract the Widevine PSSH from the MPD
mpd  = requests.get(mpd_url).text
pssh = re.search(
    r'urn:uuid:edef8ba9[^"]*"[^>]*>\s*<cenc:pssh[^>]*>([^<]+)',
    mpd).group(1)

# 5) One-shot extraction via CDMPOOL — done
out = requests.post(f"{CDMPOOL}/api/extract", json={
    "token": TOKEN, "drm": "widevine",
    "pssh": pssh, "license_url": lic_url,
    "mpd_url": mpd_url,
    "channel_name": "Télé-Québec — Jeunesse",
}).json()

for k in out["keys"]:
    print(f"--key {k['kid']}:{k['key']}")
# Ready-to-play xaccel URL is available in /me/extractions after each success.

Adapting to other services — replace the "discovery" step (1-3) with the one specific to the service (e.g. Amazon Prime uses atv-ps.primevideo.com/cdp/catalog/GetPlaybackResources). The /api/extract call in step 5 is always the same regardless of the target service — CDMPOOL detects the license server format and handles the crypto for you.

6. Error responses & error codes

HTTP status returned by /api/extract, /api and /pr/api

Every failing response includes a stable error_code + a human hint

Sample failing response:

{
  "ok": false,
  "step": "challenge",
  "status": 400,
  "error_code": "E_PSSH_NOT_BASE64",
  "hint": "PSSH is not valid base64. Copy the exact base64 string inside
           <cenc:pssh>…</cenc:pssh> in the MPD (Widevine block,
           schemeIdUri urn:uuid:edef8ba9-…-21ed). No line breaks, no XML tags."
}

All error codes (branch on error_code, never on the hint text)

Programmatic branching (Python)

r = requests.post("https://cdmpool.xyz/api/extract", json=payload).json()
code = r.get("error_code", "")
if code == "E_LICENSE_UNAUTHORIZED":
    payload["headers"]["Authorization"] = "Bearer " + fresh_token()
elif code in ("E_PSSH_MISSING", "E_PSSH_NOT_BASE64"):
    print("Fix your PSSH:", r["hint"])
elif code == "E_LICENSE_RATE_LIMITED":
    time.sleep(60)