Forensic Watermarking with NextGen Live

In this topic, you will learn how to use the Live module to create a NextGen Live channel with Forensic Watermarking, which embeds an invisible, per-viewer watermark so leaked live content can be traced back to the individual viewer.

Overview

Forensic Watermarking protects your premium live content by embedding an invisible, viewer-specific mark into each viewer's stream. The video looks identical to every viewer and there is no impact on quality — but if someone illegally re-streams or leaks your content, the mark can be read back from the leaked video to identify exactly which viewer it came from. It is a strong deterrent against piracy of high-value live events such as sports, pay-per-view, and premieres.

Each viewer is identified by a watermark ID (WMID) — a number that you assign and map to a subscriber. Brightcove embeds the number invisibly; you keep the private "which number = which subscriber" mapping, so your viewers' identities stay with you. Forensic Watermarking for Live is powered by NAGRA NexGuard.

Requirements

This feature is a paid add-on for your account. Contact your Customer Success Manager to enable it. Before you begin, note:

  • Your account must be enabled for Forensic Watermarking (paid add-on) and for Playback Authorization (Playback Rights / EPA).
  • Forensic Watermarking is available for live video channels only — not audio-only channels.
  • It cannot be combined with server-side ad insertion (SSAI).
  • It requires 2-second segments, which the Live module applies automatically when the feature is on.

Workflow

To use Forensic Watermarking with a live channel, follow these steps:

  1. Enable Forensic Watermarking on the channel in Studio
  2. Assign a per-viewer watermark ID in the playback token
  3. Preview the channel in Studio (optional)
  4. Trace a leak with a detection (if content is leaked)

Enable Forensic Watermarking in Studio

Use the Live module to create a channel with Forensic Watermarking enabled:

  1. Open the Live module and click New Channel.
  2. In the channel's advanced settings, turn on the Enable Forensic Watermarking toggle.
  3. The Live module automatically sets 2-second segments and clears server-side ad insertion (SSAI), since these are required for and incompatible with Forensic Watermarking respectively. No further configuration is needed.
  4. Enter any other channel details and click Save, then start streaming your channel.

Using the APIs instead of Studio? Set "watermark": true in the channel create request.

Assign a per-viewer watermark ID in the playback token

Forensic Watermarking uses Playback Authorization: each viewer plays with a JSON Web Token (JWT) whose wmid claim carries that viewer's watermark ID. Because the channel is watermarked, every playback request must include a wmid — a request whose token has no wmid is rejected, so there are no un-watermarked viewers on a Forensic Watermarking channel.

  1. Create a JSON Web Token (JWT) for the viewer and register your public key with Brightcove — the same mechanism used for Playback Restrictions. For details, see Creating a JSON Web Token (JWT) and Overview: Brightcove Playback Restrictions.
  2. Include the viewer's watermark ID in the token as the wmid claim. The wmid is a whole number from 1 to 8,388,607.
  3. Give every unique viewer or session a distinct wmid, and keep your own private record of which wmid maps to which subscriber. Brightcove never sees subscriber identities — only the number.

Previewing in Studio

You can preview a Forensic Watermarking channel in the Live module's built-in player to confirm it plays. Note the limitation:

  • The Studio preview plays the stream with the reserved preview watermark (watermark ID 0), not a real viewer's wmid, and uses a short-lived token (valid for 10 minutes).
  • A Studio preview is therefore never attributed to a real subscriber. To test a specific watermark ID, play the channel with a real viewer playback token that carries that wmid (see the previous step).

Tracing a leak with a detection

If your content is leaked, the watermark lets you trace it back to the responsible viewer:

  1. Capture a recording of the leaked stream — at least 3 minutes of continuous video for a reliable detection.
  2. Detection is performed by NAGRA. Reach out to NAGRA to run a detection on the recording and for full details of their detection service — your Brightcove account team can help you get in touch.
  3. The detection returns a watermark ID. Match it against your own wmid-to-subscriber records to identify the viewer the leak came from.

Learn more