Media Services supports multiple ways of authenticating users who make key requests. The content key authorization policy ...

Media Services supports multiple ways of authenticating users who make key requests. The content key authorization policy must be configured by you and met by your client in order for the key to be delivered to the client. The content key authorization policy could have an open or a token restriction.
The token restricted policy must be accompanied by a token issued by a Secure Token Service (STS). Currently, Media Services only supports tokens in the Simple Web Tokens (SWT) format. Media Services does not provide Secure Token Services. The STS must be configured to create a token signed with the specified key and issue claims that you specified in the token restriction configuration. The Media Services key delivery service will return the encryption key to the client if the token is valid and the claims in the token match those configured for the content key.
Open restriction means the system will deliver the key to anyone who makes a key request.  This restriction might be useful for testing purposes.