Media Services supports multiple ways of authenticating users who make key requests. The content key authorization policy ...

Media Services supports multiple ways of authenticating users who make key requests. The content key authorization policy must be configured by you and met by your client in order for the key to be delivered to the client. The content key authorization policy could have an open or a token restriction.  
The token restricted policy must be accompanied by a token issued by a Secure Token Service (STS). Currently, Media Services only supports tokens in the Simple Web Tokens (SWT) format. Media Services does not provide Secure Token Services. The STS must be configured to create a token signed with the specified key and issue claims that you specified in the token restriction configuration. The Media Services license delivery service will return the license to the client if the token is valid and the claims in the token match those configured for the content key.