Roku Development: Channels, DRM, and Certification

Updated October 2026: PlayReady is deprecated on Roku and Widevine is now required in the US, Canada and Latin America; certification criteria refreshed to the October 2026 edition, plus Roku OS 16.0 and the pending Fox acquisition.

Why this matters

Roku development means building an app for Roku OS in two Roku-only technologies — the BrightScript scripting language and the SceneGraph XML user-interface framework — then passing Roku's certification and publishing it in the Roku Streaming Store. As of October 2026, there is no official React Native, Flutter or HTML runtime on Roku, content protection runs on Widevine, and payments must go through Roku Pay, which keeps 20% of revenue.

For a streaming service chasing a U.S. audience, Roku is the single biggest doorway into the living room, ahead of Amazon Fire TV and Samsung — and reaching it means committing to a platform that shares almost nothing with the web, iOS, or Android builds you already maintain. A media founder, product manager, or streaming CTO who budgets "the Roku app" as one more port will be surprised three times: by a proprietary language nobody on the team knows, by a certification gate with strict performance numbers, and by monetization rules that take a cut and forbid your own payment flow. This article explains Roku in plain language — the BrightScript-and-SceneGraph stack, the SDK channel model, the certification budget, the content-protection map, and the advertising and billing rules — so you can scope a Roku build, judge a vendor's proposal, and avoid the mistakes that fail certification. It is the streaming-stick companion to the OTT client matrix, which maps every screen you must cover, and a sibling to smart TV apps: Tizen and webOS and Apple TV / tvOS and Fire TV.

Why Roku is its own world

Lead with the reach, because reach is the reason you are here. Roku is the most-used connected-TV platform in the United States: the company announced more than 100 million streaming households worldwide in April 2026, and its viewers streamed 37.9 billion hours in the second quarter of 2026, up 7% year over year (Roku shareholder letter, August 2026). Parks Associates put Roku at 28% of the U.S. connected-TV space in April 2026, ahead of Samsung at 23%, and Pixalate measured Roku at 36% of U.S. open programmatic CTV ad share in Q1 2026 against 19% for Amazon Fire TV. If your audience is American and watches on a television, a large share of them reach for a Roku remote. That is the scale requirement that puts Roku near the front of the device queue.

One corporate change belongs in any 2026 plan. On June 15, 2026, Fox Corporation agreed to buy Roku in a cash-and-stock deal worth about $22 billion, expected to close in the first half of 2027 after shareholder and regulatory approval; both companies said Roku will keep operating as an open, partner-friendly platform. As of October 2026 the developer rules described below — the SDK, certification, Widevine and Roku Pay — are unchanged, so the deal is a watch item for your roadmap, not a reason to pause a build.

Now the cost side, because it is the part that surprises teams. Roku is a closed, purpose-built platform, not a general-purpose computer. You cannot ship a web app inside a browser the way you can on Samsung Tizen or LG webOS, and you cannot reuse your Android code the way you can on Amazon Fire TV. A Roku app is written from scratch in Roku's own tools, runs on Roku's own operating system, and is distributed only through Roku's own store under Roku's own rules. Every layer is Roku's. The reach is unmatched, and so is the lock-in.

The practical consequence is a separate codebase with a separate skill set. The reach buys you a large, hard-to-reach audience; the platform charges you a dedicated team to serve it. The rest of this article walks the four parts of that platform — the language, the channel model, the certification gate, and the protection-and-money rules — so the trade is one you make with open eyes.

Figure 1. Roku is its own world. The web (HTML/JS) and mobile (Swift/Kotlin) stacks do not carry over; a Roku app is BrightScript plus SceneGraph on Roku OS.

BrightScript and SceneGraph: the two pillars

What programming language does Roku use? Roku apps are written in BrightScript, a language Roku created for its devices, with screens built in SceneGraph; Roku's own development overview names only these two. BrightScript is a lightweight scripting language whose syntax sits somewhere between BASIC and a stripped-down JavaScript: readable, but its own dialect, with its own quirks and its own standard library. SceneGraph is Roku's user-interface framework, in which every screen is built from a tree of pre-defined nodes (buttons, labels, grids, lists, a video node) described in XML, and the behaviour of those nodes is driven by BrightScript code. A useful analogy: SceneGraph is to a Roku app what the HTML page structure is to a website, and BrightScript is the scripting that makes it move — except both are Roku-only. Many teams now write in BrighterScript, an open-source superset from the RokuCommunity project that adds classes, namespaces and imports and compiles down to plain BrightScript, so the device still runs BrightScript.

The "Roku-only" part is the whole point, and it has a budget attached. A senior web engineer's React skills, an iOS engineer's Swift, an Android engineer's Kotlin — none of them transfer. Your team either learns BrightScript and SceneGraph or you hire people who already know them, and the pool is small because the skill is useful on exactly one platform. Tooling is thinner than the mainstream platforms too: there is no first-party full IDE on the level of Xcode or Android Studio. Roku supplies the BrightScript Profiler, the Roku Resource Monitor, app tracing with Perfetto, a Static Analysis tool and Roku WebDriver for automated tests; most teams edit and debug in the community BrightScript Language extension for Visual Studio Code, which reads the device log over the network. Cross-platform shortcuts do not reach the device: React Native and Flutter have no Roku target, so "one codebase for every TV" stops at Roku. None of this makes Roku hard, exactly — it makes Roku separate, and separate is what costs money over the life of the product.

The platform does keep moving. Roku OS 16.0 reached developers as a beta in September 2026, with a rollout to TVs and sticks "over the coming months": it adds a WebSocket API and server-pushed event streams for chat and live polls, GPU-drawn rounded corners and borders for tiles, and deprecation warnings for some direct-draw calls used by games and screensavers. Most video apps need no changes, but budget a regression pass on the new OS before it reaches your viewers.

Roku's old no-code route, Direct Publisher, is gone (details in the next section), so every Roku app now needs BrightScript.

The channel model: SDK apps only

Roku used to call a published app a "channel" and its store the Roku Channel Store; its documentation now says "app" and "Roku Streaming Store," though developers and search queries still say "channel." Either way, as of today there is exactly one way to make one that the store will accept: a full SDK app built in BrightScript and SceneGraph. The no-code Direct Publisher path was wound down — Roku stopped allowing new Direct Publisher channels in 2023 and removed the remaining ones from the platform in January 2024 — so any guide that still tells you to "just upload a feed" is out of date. If you want a custom interface, digital rights management, user accounts, or advertising, you needed the SDK even before the sunset; now you need it for everything.

The distribution flow is Roku's own. You develop and sideload the app onto a real device for testing, package it, and submit it through the Roku Developer Dashboard to the Roku Streaming Store. Discovery and install happen inside Roku's storefront, and updates re-enter the same pipeline. One detail catches teams late: Roku requires apps to support deep linking — the ability for Roku's search and its home-screen content rows to send a viewer straight into a specific title in your app, and to begin playback directly ("Direct to Play") rather than dropping them on your home screen. Deep linking is not a nice-to-have on Roku; it is a certification requirement, because Roku's own content discovery depends on it.

Getting onto the device: certification

Every Roku app must pass certification before it reaches the store, and Roku's certification criteria (last updated October 2026) are organized into six areas: advertising, accounts and purchases, performance, app operation, deep linking, and UI and graphics. Two of those areas — performance and accounts/purchases — are where first builds most often fail, because they carry hard, measured numbers rather than soft guidance.

The performance limits are specific, and Roku measures them on low-end hardware — the Roku Streaming Stick+ (3810X) or Roku Premiere+ (3921X), not a top-of-the-line Roku Ultra. Your app must launch to a fully rendered home screen within 15 seconds, move between screens within 3 seconds, respond to a remote-button press within 250 milliseconds, and start playing content within 8 seconds of the viewer pressing play. And the whole app package must be 4 megabytes or smaller. That last number shocks teams used to mobile, where a 100-megabyte app is unremarkable; on Roku, a bloated bundle of images and fonts simply will not certify. These limits exist because the install base includes inexpensive, memory-constrained streaming sticks, and Roku will not let an app that crawls on a cheap stick degrade the platform's reputation.

Roku certification criteria at a glance (October 2026 edition):

Bigger apps carry extra obligations, set by average monthly streaming hours over the past three months: at 1 million hours a month, apps that require login must support Automatic Account Link; at 5 million, all supported voice controls, Continue Watching and, in the U.S., Instant Resume; at 10 million, subscription apps must offer Instant Signup. Outside the U.S., Continue Watching already applies at 1 million hours. Roku applies these to new apps it expects to cross the line soon after launch, so a large catalogue moving onto Roku should plan them into the first release.

The testing rule follows from the same logic: Roku requires you to test on multiple device models with varying processing power and memory before you submit, and it explicitly tells you to include the weaker, older models in that suite. The mistake to avoid is developing and demoing only on a fast, current Roku Ultra and discovering at certification that the app misses the 250-millisecond and 15-second budgets on the cheap stick a real customer actually owns. Roku also provides automated pre-submission tools — a Static Analysis tool that checks your code structure and an App Behavior Analysis tool — and an app must pass them to be published.

Figure 2. The certification gate. Six criteria areas, hard performance numbers, and the rule that they are measured on a low-end device — not your fast Ultra.

Content protection on Roku: a different map

Now the part a studio contract turns on, and where Roku diverges most from the web and the TVs. Premium content needs a lock that stops a paying viewer's device from copying it, called digital rights management (DRM). On the web and on Samsung/LG televisions, the app requests decryption keys through a browser standard called Encrypted Media Extensions (EME), the W3C recommendation. Roku does not use EME at all — there is no browser in the picture. Instead, your BrightScript code configures DRM directly on the SceneGraph video node, passing the key-system name and the license-server address as native properties. If you are coming from a web or smart-TV build, this is the single biggest structural difference: same DRM systems underneath, completely different wiring above.

Which DRM does Roku support? As of October 2026, Widevine. Roku's content-protection documentation (updated October 2026) marks PlayReady as deprecated: Roku requires apps in the United States, Canada and Latin America to use Widevine, PlayReady support in those regions ended after June 30, 2025, and only apps in the UK Streaming Store may still use PlayReady, with Roku "strongly" encouraging migration. The streaming formats are HTTP Live Streaming (HLS), Apple's format standardized as IETF RFC 8216, and MPEG-DASH, the ISO format in ISO/IEC 23009-1; Microsoft's older Smooth Streaming no longer appears in Roku's matrix. The current mapping is:

Read it carefully. Google's Widevine runs over both HLS and DASH and is the one studio-grade system Roku supports everywhere; PlayReady survives only on DASH in the UK store; simple AES-128 encryption, which is not DRM, rides on either format. The conclusion has changed since 2024: a Roku plan is now a Widevine plan, and a back end that packaged PlayReady-only DASH for Roku has to add Widevine before it can serve North American viewers. Widevine also needs an entry in the app manifest, and Roku lists Widevine L1 on many TV and player models and L2 on older ones, so check the security level your studio contract demands against your device matrix. Apple's FairPlay, the third big DRM system, does not appear at all: like on the TVs, FairPlay is confined to Apple's own hardware and is absent on Roku.

A few dated, vendor-specific details belong in any current Roku plan, exactly the kind of facts that age and must be re-checked. Roku removed support for Verimatrix DRM in Roku OS 9.3 and has since deprecated PlayReady, so Widevine is the system to design around. Widevine version 16 is supported since Roku OS 9.4 on devices without dedicated secure processors. For the encryption scheme itself, Roku's Widevine support covers both the counter-mode (CTR) and cipher-block-chaining (CBC/CBCS) schemes of Common Encryption (ISO/IEC 23001-7), with key rotation available since firmware 9.0.x — so unlike the older smart-TV fleet, the modern "encrypt once with cbcs" convergence is generally workable on current Roku hardware, though you confirm scheme coverage against your actual device matrix. The scheme mechanics in full are in CENC, CTR, and CBCS: common encryption explained, the three systems in Widevine, PlayReady, FairPlay, and the one-workflow approach in multi-DRM: one workflow, every device.

One more layer sits on the cable, not in the software. High-bandwidth Digital Content Protection (HDCP) protects the video as it travels over HDMI from the Roku to the screen. Roku's 4K-capable devices support HDCP 2.2, which studios require for 4K and HDR; non-4K devices use the older HDCP 1.4, and a 4K device set to a non-4K display type defaults to HDCP 1.4. The practical effect a viewer sees: if any device in the HDMI chain — TV, receiver, cable — is not HDCP 2.2 compliant, the 4K title drops to a lower resolution or shows an error. DRM protects the stream and the keys; HDCP protects the last hop to the panel; neither stops a camera pointed at the screen, so be precise about what each layer does. How HDCP works, in one line: before sending protected video, the Roku checks that the TV and anything in between holds valid HDCP keys, then encrypts the picture on the HDMI cable; if that handshake fails, the title is downgraded or blocked. Your app can read the negotiated version with ifHdmiStatus.getHDCPVersion() and pick a lower rendition instead of showing an error.

Figure 3. The Roku protection map, October 2026. Widevine is the default on HLS and DASH; PlayReady survives only in the UK store; DRM is wired natively in BrightScript, not through the browser's EME; HDCP guards the HDMI hop.

Monetization: the Roku Advertising Framework and Roku Pay

Roku's money rules are as distinctive as its language, and they are enforced at certification, so they are not optional. They split along the two ways a streaming service earns: advertising and direct payment.

For advertising, Roku requires the Roku Advertising Framework (RAF) — a Roku-provided library that ships with Roku OS and renders pre-roll, mid-roll, and post-roll video ads and fires the measurement beacons that tell advertisers an ad actually played. Any app that runs video advertising must integrate RAF to pass certification, and the rule has teeth: ad-tracking beacons must be fired client-side by RAF, not wrapped or fired by your own code, so that Roku can apply its advertising watermark and the measurement is trusted. Custom ad parsing and rendering outside RAF needs explicit approval from Roku, and for audience measurement RAF's enableAdMeasurements call has replaced the older enableNielsenDAR. This holds even when you use server-side ad insertion (SSAI) — the technique that stitches ads into the video stream on the server so they are harder to block — covered in server-side ad insertion (SSAI) vs client-side (CSAI). Roku ships SSAI adapters for six providers — uplynk, adobe, onceux, yospace, awsemt (AWS Elemental MediaTailor), and ggldai (Google Dynamic Ad Insertion) — and even with SSAI, the beacons still route through RAF client-side. The broader ad stack and the VAST standard that describes the ads live in ad serving, VAST/VMAP, and the ad stack.

For direct payment, Roku requires Roku Pay — Roku's own billing system — and forbids you from sending viewers to any other payment method. If your app sells subscriptions, rentals, or one-time purchases, sign-up, payment, and entitlement run through Roku Pay, and you "may not facilitate or direct customers to use any method of payment" other than Roku Pay. The price of that is a revenue share: Roku pays you 80% of what it actually collects from viewers after taxes, refunds and chargebacks and keeps 20%, in exchange for handling billing, payment processing, and refunds. Payouts arrive no later than 60 days after the end of each month, with no minimum for Roku Pay, and longer plans are paid out pro rata — an annual subscription arrives as 1/12 a month.

Walk the arithmetic out loud, because it changes a business model. Suppose your subscription is $9.99 a month. Roku's 20% cut is $9.99 × 0.20 = $2.00, leaving you 80%, or $7.99, per subscriber per month. Now scale it: at 100,000 paying subscribers, gross is $9.99 × 100,000 = $999,000 a month; Roku's 20% is about $199,800, and your 80% is $799,200. Over a year, Roku's share of that single cohort is roughly $2.4 million. That is not a hidden fee — it is the platform's price for access to the largest U.S. streaming audience and for running the billing — but it has to be in your pricing model from day one, alongside the cost of building and certifying a separate app. How that fits the wider revenue picture is in subscription billing and entitlement.

Figure 4. Two money paths, both Roku's. Ads must use RAF with client-side beacon firing; payments must use Roku Pay, which keeps 20% and remits 80%.

Common mistake — the six that fail a Roku launch. First, budgeting Roku as a "port" of the web or mobile app; it is a separate BrightScript/SceneGraph codebase and a separate skill set. Second, ignoring the 4 MB app-size limit and the performance budget, then failing certification on a cheap stick after developing on a fast Ultra — test on the low-end model. Third, assuming the no-code Direct Publisher route still exists; it was removed in January 2024, so you need a full SDK channel. Fourth, firing your own ad beacons or skipping RAF; ad-supported apps must route beacons client-side through RAF to certify. Fifth, planning a third-party paywall; Roku Pay is mandatory for transactions and you cannot point viewers elsewhere. And a sixth that is new since 2025: packaging PlayReady-only DASH for Roku; outside the UK store it no longer plays, so Widevine has to be in the packaging plan.

How to check a Roku vendor's proposal

A credible Roku proposal answers six questions in writing; a vendor who cannot answer them has not shipped a certified Roku app recently.

• Which low-end devices do you test on, and does the plan budget the 15-second launch, 250-millisecond response and 4 MB package against the Streaming Stick+ (3810X) or Premiere+ (3921X)?
• Is the app a full SDK build in BrightScript or BrighterScript and SceneGraph, with deep linking and Direct to Play for every media type?
• Is content protected with Widevine, and is the packaging pipeline ready for it rather than PlayReady-only DASH?
• Do ads run through RAF with client-side beacons, including on SSAI streams?
• Do all purchases go through Roku Pay, with sign-up and upgrades on the device and no external payment pages?
• Who owns regression testing when a new Roku OS, such as 16.0, reaches viewers?

Roku development FAQ

What programming language is used for Roku apps?

BrightScript, Roku's own scripting language, with screens built in the SceneGraph XML framework. BrighterScript, a community superset, compiles to BrightScript; there is no official JavaScript, React Native or Flutter runtime on Roku.

Can I build a Roku app with React Native?

No. As of October 2026, React Native has no Roku target, so a Roku app is a separate BrightScript and SceneGraph codebase even when your web, mobile and Fire TV apps share one.

What are the Roku certification criteria?

Six areas — advertising, accounts and purchases, performance, app operation, deep linking, and UI and graphics — with hard limits of 4 MB package size, 15 seconds to launch, 3 seconds per screen transition, 250 milliseconds remote response and 8 seconds to start playback, measured on low-end Roku devices (October 2026 edition).

Which DRM does Roku support?

Widevine over HLS and DASH, plus plain AES-128 encryption, which is not DRM. PlayReady is deprecated: support ended in the US, Canada and Latin America after June 30, 2025, and only UK Streaming Store apps may still use it. FairPlay is not supported.

How does HDCP protect Roku video?

HDCP encrypts the video on the HDMI cable after a handshake confirms the TV holds valid keys; Roku's 4K devices use HDCP 2.2, which studios require for 4K, and other devices use HDCP 1.4.

How much does Roku take from subscriptions?

Roku Pay keeps 20% and pays the developer 80% of collected revenue, net of taxes, refunds and chargebacks, within 60 days after month end; a $9.99 subscription nets you about $7.99.

Where is the official Roku developer documentation?

At developer.roku.com: the development overview, the certification criteria, the content-protection page and the Roku Advertising Framework guides are the four pages a Roku build is checked against.

Does the Fox acquisition change Roku development?

Not yet. Fox agreed to buy Roku on June 15, 2026 for about $22 billion, with closing expected in the first half of 2027; both companies said Roku stays an open platform, and the SDK and certification rules are unchanged as of October 2026.

Where Fora Soft fits in

Roku is where a U.S. streaming service meets its largest living-room audience, and the scale problem is not one screen — it is a closed platform that demands a dedicated BrightScript and SceneGraph codebase, a 4-megabyte performance budget on low-end hardware, native DRM wiring, and Roku's own advertising and billing rules, all at once. Fora Soft has built video streaming, OTT/Internet TV, e-learning, and telemedicine applications since 2005 — 250+ projects across 20+ years — so the Roku realities here (the SDK channel model, certification against the performance numbers, Widevine configured natively in BrightScript now that PlayReady is deprecated, and RAF plus Roku Pay) are the day-to-day of our streaming work. We are vendor-neutral: we translate each platform's rules into a build rather than reselling a single SDK, and we scope the device matrix so Roku earns its place beside the web, mobile, and TV apps instead of doubling your maintenance by surprise. If Roku is next on your device list, our OTT and Smart TV app development team builds and certifies the channel alongside your other apps, and our streaming backend development work keeps DRM and packaging consistent across every screen.

The handbook

Fora Soft Video Engineering Handbook

We wrote a seven-volume handbook, 9,000+ pages, that takes the video stack from a single pixel to production — encoding, delivery, audio and AI — and someone who works through it can design and build the service a Roku channel is the living-room face of. Volume 3 is the one to open next to this article: it covers players on every screen, the DRM systems behind the Widevine column above and the PlayReady one Roku is retiring, and the delivery economics that decide what each of those viewers costs you. Volume 2 covers the transport and packaging the channel plays — ingest, HLS and MPEG-DASH — and volume 1 covers the codecs and the encoding ladder that decide whether the stream starts inside Roku's 8-second budget. Written by Nikolay Sapunov, CEO at Fora Soft.

Browse the handbook on Amazon →7 volumes · Kindle & paperback

See our case studies

References

1. HTTP Live Streaming (HLS) — IETF RFC 8216. IETF, 2017. The HLS format Roku carries Widevine and AES-128 over; the controlling source for HLS structure. Tier 1. https://www.rfc-editor.org/rfc/rfc8216
2. Dynamic adaptive streaming over HTTP (MPEG-DASH) — ISO/IEC 23009-1. ISO/IEC. The DASH format Roku carries Widevine (and, in the UK store only, PlayReady) over. Tier 1. https://www.iso.org/standard/83314.html
3. Common Encryption (CENC) — ISO/IEC 23001-7. ISO/IEC. Defines the CTR and CBC/CBCS schemes Roku's Widevine support references; the basis of the encryption-scheme decision. Tier 1. https://www.iso.org/standard/68042.html
4. Encrypted Media Extensions (EME). W3C Recommendation, 18 September 2017. The browser DRM standard used on web and smart TVs — and the one Roku notably does NOT use, configuring DRM natively in BrightScript instead. Tier 1. https://www.w3.org/TR/encrypted-media/
5. VAST (Video Ad Serving Template) 4.x. IAB Tech Lab. The ad-response standard behind the video ads RAF renders. Tier 1. https://iabtechlab.com/standards/vast/
6. DRM & content protection — Roku Developer Docs. Roku, updated October 2026. PlayReady deprecated and ended in the US, Canada and Latin America after June 30, 2025 (UK store only); Widevine required; the DRM-to-format matrix across HLS/DASH; native BrightScript drmParams/keySystem configuration; Widevine security levels; the Verimatrix removal in Roku OS 9.3; CTR and CBC/CBCS schemes; HDCP 2.2/1.4 and getHDCPVersion(). Tier 3 (first-party), fetched 2026-10-24. https://developer.roku.com/dev/docs/content-protection
7. Certification criteria — Roku Developer Docs. Roku, last updated October 2026. The six criteria areas and the performance budget: 4 MB app size, 15 s launch, 3 s screen transitions, 250 ms remote response, 8 s content start, test devices 3810X and 3921X, streaming-hour thresholds, deep linking, and the Roku Pay mandate. Tier 3 (first-party), fetched 2026-10-24. https://developer.roku.com/dev/docs/certification
8. Integrating the Roku Advertising Framework — Roku Developer Docs. Roku. RAF as the ad library (custom rendering only with Roku approval), client-side beacon firing and the Roku Advertising Watermark, enableAdMeasurements replacing enableNielsenDAR. Tier 3 (first-party), fetched 2026-10-24. https://developer.roku.com/dev/docs/integrating-roku-advertising-framework
9. Implementing Server-Side Ad Insertion Using Roku Adapters — Roku Developer Docs. Roku. The six SSAI adapter values (uplynk, adobe, onceux, yospace, awsemt, ggldai) and the rule that beacons still fire client-side through RAF. Tier 3 (first-party), fetched 2026-10-24. https://developer.roku.com/dev/docs/ssai-adapters
10. Monetization & billing (Roku Pay) — Roku Developer Docs. Roku. The 80/20 revenue share on subscriptions and one-time purchases and Roku's management of billing and payment. Tier 3 (first-party). https://developer.roku.com/docs/features/monetization/billing.md
11. Roku Surpasses 100 Million Streaming Households. Roku Newsroom, April 2026. The 100M+ global streaming-household milestone. Tier 5 (vendor PR / orientation). https://newsroom.roku.com/news/2026/04/roku-surpasses-100-million-streaming-households-a-historic-milestone/cbdb6hs7-1776191291
12. Parks Associates: Roku (28%) and Samsung (23%) dominate U.S. connected-TV platforms. Parks Associates via PR Newswire, April 2026. U.S. CTV platform share; orientation figures. Tier 5 (industry). https://www.prnewswire.com/news-releases/parks-associates-roku-28-and-samsung-23-dominate-connected-tv-platforms-controlling-access-to-streaming-audiences-in-the-us-market-302749732.html
13. Roku Q2 2026 shareholder letter. Roku, August 6, 2026. 37.9 billion streaming hours in Q2 2026 (+7% YoY), 100 million+ households, the pending Fox transaction. Tier 3 (first-party). https://image.roku.com/bWFya2V0aW5n/ShareholderLetter2Q26final.pdf
14. Pixalate Q1 2026 Global Connected TV Device Market Share Reports. Pixalate via GlobeNewswire, May 6, 2026. Roku 36%, Fire TV 19%, Samsung 15% of U.S. open programmatic CTV ad share. Tier 5 (industry). https://www.globenewswire.com/news-release/2026/05/06/3289183/0/en/Pixalate-s-Q1-2026-Global-Connected-TV-Device-Market-Share-Reports-Roku-Leads-in-North-America-36-and-LATAM-42-Aiwa-No-1-in-APAC-21-Samsung-Smart-TV-Leads-in-EMEA-28.html
15. Fox buying streaming platform Roku in cash-and-stock deal worth about $22 billion. Associated Press via ABC7, June 15, 2026. Deal terms, expected close in the first half of 2027, open-platform commitment. Tier 5 (news). https://abc7.com/post/fox-buying-streaming-platform-roku-cash-stock-deal-worth-22-billion/19301345/
16. Publisher payouts — Roku Developer Docs. Roku. 80% of collected Roku Pay revenue net of taxes, refunds and chargebacks; payment within 60 days after month end; pro-rata payout for longer plans. Tier 3 (first-party), fetched 2026-10-24. https://developer.roku.com/dev/docs/payouts
17. Roku development overview — Roku Developer Docs. Roku, updated May 2026. SceneGraph and BrightScript as the app stack; Roku's profiler, Resource Monitor, Perfetto tracing, Static Analysis and WebDriver tooling. Tier 3 (first-party), fetched 2026-10-24. https://developer.roku.com/dev/docs/roku-overview
18. BrighterScript. RokuCommunity, GitHub. The open-source BrightScript superset that compiles to BrightScript. Tier 4 (open-source project). https://github.com/rokucommunity/brighterscript
19. Roku Starts Testing Roku OS 16 With New Features & Better-Looking Apps. Cord Cutters News, September 24, 2026. Roku OS 16.0 developer beta: WebSocket and event-stream APIs, GPU corner and border effects, direct-draw deprecations. Tier 5 (news). https://cordcuttersnews.com/roku-starts-testing-roku-os-16-with-new-features-better-looking-apps/

Where sources disagreed, the official spec or the first-party Roku doc was followed. The widespread listicle claim that you "publish a Roku channel by uploading a feed" was overridden by Roku's own deprecation of Direct Publisher (new channels stopped 2023, existing removed January 2024) — SDK channels are now the only path. The common assumption that smart-TV/web DRM "uses EME everywhere" was overridden by Roku's content-protection docs, which configure DRM in native BrightScript and never reference EME. In October 2026 the older "Widevine and PlayReady over DASH" advice still common in guides was overridden by Roku's own deprecation of PlayReady outside the UK store.