> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blindcast.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Quick Start

> See encrypted HLS playback in ~10 minutes. Generate keys, encrypt sample video, start a local key server, and play it back in the browser.

This tutorial walks you through the entire BlindCast pipeline — from generating keys to playing encrypted video in your browser. No prior setup required.

<Tip>
  **Want the fastest path?** If you have Docker, use the [BlindCast Server](/server/overview) — a single `docker compose up` gives you key derivation, content registry, presigned uploads, and an admin dashboard. The tutorial below uses the CLI for a step-by-step walkthrough.
</Tip>

## Step 1: Install the CLI

```bash theme={null}
npm install -g @blindcast/cli
```

## Step 2: Create a sample project

```bash theme={null}
blindcast init my-first-video
cd my-first-video
```

This creates a directory with sample HLS segments, a player page, and a `.env.example` file. See [`blindcast init`](/cli/init) for details.

```
my-first-video/
├── segments/
│   ├── manifest.m3u8
│   ├── seg-0.ts
│   ├── seg-1.ts
│   └── seg-2.ts
├── player.html
└── .env.example
```

## Step 3: Generate keys

```bash theme={null}
blindcast keygen > .env
source .env
```

This creates a `.env` file with `BLINDCAST_MASTER_KEY` and `BLINDCAST_SALT`, then loads them into your shell. See [`blindcast keygen`](/cli/keygen) for details.

<Warning>
  In production, store these in a secret manager. For this tutorial, a local `.env` file is fine.
</Warning>

## Step 4: Encrypt the segments

```bash theme={null}
blindcast encrypt ./segments --content-id demo-001
```

```
Encrypting 3 segments in ./segments...
  [100%] 3/3 segments encrypted
Manifest rewritten with EXT-X-KEY tags.
Output: ./segments/encrypted/
```

The encrypted segments and rewritten manifest are in `./segments/encrypted/`. The original segments are untouched.

## Step 5: Start the key server

In one terminal:

```bash theme={null}
blindcast serve
```

```
BlindCast key server running on http://localhost:4100
```

The key server derives content keys from your master key and serves them to the player. See [`blindcast serve`](/cli/serve).

## Step 6: Play the video

In a second terminal, serve the files and open the player:

```bash theme={null}
npx serve .
```

Open `http://localhost:3000/player.html` in your browser. You should see the sample video playing — decrypted in real-time inside the browser.

## What just happened?

```mermaid theme={null}
sequenceDiagram
  participant CLI as CLI (you)
  participant Disk as Local files
  participant KS as Key Server (localhost:4100)
  participant Browser as Browser (player.html)

  CLI->>Disk: blindcast encrypt → encrypted segments + manifest
  Note over KS: blindcast serve (running)
  Browser->>Disk: GET manifest.m3u8
  Browser->>KS: GET /keys/demo-001
  KS->>KS: HKDF derive key from master key
  KS-->>Browser: content key (16 bytes)
  Browser->>Disk: GET encrypted seg-0.ts
  Browser->>Browser: Decrypt with content key
  Browser-->>Browser: Render video frames
```

1. **`blindcast encrypt`** encrypted each `.ts` segment with AES-128-CBC and injected `EXT-X-KEY` tags into the manifest
2. **`blindcast serve`** started a key server that derives content keys from your master key using HKDF
3. **The player** (in `player.html`) fetched the manifest, requested the content key from the key server, and decrypted each segment in the browser
4. **Your server** (the static file server and key server) never saw the plaintext video — only encrypted bytes

## Next steps

| What you want to do                 | Go to                                                                   |
| ----------------------------------- | ----------------------------------------------------------------------- |
| Add the player to your web app      | [Player docs](/player/overview)                                         |
| Play with React                     | [Player Basic Usage — React example](/player/basic-usage#react-example) |
| Upload encrypted video to S3        | [`blindcast upload`](/cli/upload)                                       |
| Add browser-side upload to your app | [Uploader docs](/uploader/overview)                                     |
| Run the full server (Docker)        | [Server docs](/server/overview)                                         |
| Deploy a production key server      | [Key Server docs](/key-server/overview)                                 |
| Deploy to Cloudflare Workers        | [Workers guide](/serverless/cloudflare-workers)                         |
| Deploy to AWS Lambda                | [Lambda guide](/serverless/aws-lambda)                                  |
| Use Cloudflare R2 for storage       | [R2 setup](/serverless/cloudflare-workers#storage-r2)                   |
| Go to production                    | [Production Checklist](/production/checklist)                           |