Abstract: A method and apparatus for providing a license to a client device, the license providing a key for decrypting a content instance. In one embodiment, the method comprises accepting a token request, the token request having client device credentials including a client device identifier (client ID) and a content instance identifier (content ID), deriving a private key according to a token key seed, a token key identifier (token key ID), and the content ID, generating a token having a payload and a token identifier (token ID) and being digitally signed according to the derived private key; transmitting the generated token to the client; and providing the license to the client device according to the generated token.

Abstract: A method and apparatus for providing a license to a client device, the license providing a key for decrypting a content instance. In one embodiment, the method comprises accepting a license request, the license request including a client identifier and an access token having an access token identifier and key request data comprising a content identifier identifying the content instance, determining if the received access token identifier is currently bound to a stored client device identifier, and temporarily binding the received access token identifier with the received client device identifier and providing the received access token for validation or returning an error without providing the received access token for validation depending upon the determination.