AES-128 key loading failures
| Signal | What it means | What to test |
|---|---|---|
| #EXT-X-KEY is present | The HLS playlist references an encryption key before encrypted segments. | Confirm the METHOD is AES-128 and inspect the key URI. |
| Key URI returns 403 | The key endpoint refuses direct access or needs original playback context. | Try a fresh URL, proxy route, and required Referer if you are allowed to access it. |
| Key URI has no CORS | The browser can see the manifest but cannot read the key response. | Route the manifest, key, and segments through the same CORS-readable proxy. |
| Relative key URI | The key URL is resolved relative to the playlist URL. | Make sure proxy rewriting preserves the correct base URL. |
| License server required | The stream is DRM-protected rather than normal AES-128 HLS. | Use the authorized app. This tool does not bypass DRM. |
How to fix an M3U8 key loading error
- 1Inspect the #EXT-X-KEY tagRun the health report or open the manifest and find #EXT-X-KEY. Confirm the method is normal AES-128 and note whether the key URI is absolute or relative.
- 2Load the key through the same routeIf playback uses the proxy, the key must also use the proxy. Mixing direct key requests with proxied segments often causes browser or origin rejection.
- 3Check HTTP status and CORSA 403 means the server refused the key. A CORS error means the browser could not read the key response. They require different fixes.
- 4Set Referer for protected key endpointsIf the key server expects the original playback page, set that page as Referer through the proxy and retry the stream.
- 5Confirm it is not DRMIf the manifest depends on a license server or DRM stack, stop testing in this tool and use the licensed player.
Why key access breaks after the manifest loads
An encrypted HLS stream can expose its playlist while protecting the key URL more strictly than the segments. That makes the first .m3u8 file look valid, but playback fails when the browser tries to fetch the key needed to decrypt the next media segment.
Why relative key URIs are easy to proxy incorrectly
Many playlists use a relative key URI such as keys/stream.key. The player resolves it against the media playlist URL, not your page URL. A proxy must preserve that base path or rewrite the key request correctly, otherwise the browser asks the wrong endpoint.
How key loading affects MP4 and MP3 export
The converter cannot remux MP4 or extract MP3 from encrypted HLS until it can fetch the AES-128 key and the matching media segments. Fix key access in playback first, then run export. DRM-protected streams still require the authorized app.
Related encrypted HLS pages
- Encrypted M3U8 player explains the difference between normal AES-128 HLS and DRM systems.
- M3U8 403 Forbidden covers server-side denial on manifests, keys, and media segments.
- HLS CORS error shows why key URLs need browser-readable responses, not just reachable URLs.
Frequently asked questions
Why is my M3U8 key not loading?
The key usually fails because the AES-128 key URI is blocked by CORS, returns 403, expired with the signed URL, requires a specific Referer, or belongs to a DRM workflow rather than normal HLS encryption.
What is #EXT-X-KEY in an M3U8 file?
#EXT-X-KEY tells the player how HLS segments are encrypted and where to fetch the key. For AES-128 HLS, the key URI must be reachable before playback or conversion can decrypt the segments.
Can a CORS proxy fix AES-128 key loading?
Yes, when the issue is browser access. The proxy must route the manifest, key URI, and media segments together so every HLS request is readable by the browser.
Why does VLC play the encrypted M3U8 but the browser fails?
VLC is not restricted by browser CORS rules and may send a different request shape. If VLC works but the browser fails, check CORS, Referer, User-Agent, and proxy routing for the key URL.
Does a key loading fix bypass DRM?
No. Normal AES-128 key access is part of standard HLS playback when you are allowed to fetch the key. DRM systems such as Widevine, FairPlay, and PlayReady still require licensed playback.