On this page

Meeting Tokens

A meeting token admits one person to one room and says what they may do there.

Your server makes a meeting token with its secret key and gives it to the browser. The token is a signed JWT (EdDSA, Ed25519). It works in one room only and expires, so it is safe to put in a page address or an app.

Make one#

bash

curl "https://meet.respiresoft.com/api/v1/rooms/order-1042/tokens" \
  -H "Authorization: Bearer $MEET_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"user_id": "u-77", "name": "Ann", "role": "participant", "perms": ["audio", "video", "chat"], "ttl": 3600}'

The answer has token, a join url with the token in it, role, perms, user_id, name and expires_at.

Roles#

Role	What the person can do
`host`	Everything a participant can, plus host powers (admit people, mute, remove, end the call). A host token gets into a locked room.
`participant`	Join, speak, show video, chat and share their screen, within `perms`.
`viewer`	Watch and listen only. Never publishes audio, video or screen.

Permissions#

perms is a list. Leave it out and the role's defaults apply.

Permission	Allows
`audio`, `video`, `screen`	Publishing that source. Without it the engine refuses it. Screen audio needs `screen`.
`chat`	Sending chat messages.
`record`	Starting and stopping a recording (hosts can always). Never for a viewer.
`translate`	Using live translation.
`admin`	Administrative controls.

Claims#

Claim	Meaning
`iss`	Always `meet`
`aud`	Always `meet-room`
`room`	The room's name. The token works in no other room.
`sub`	Your own user id (the `user_id` you sent), optional
`name`	The name shown in the room. The person cannot change it.
`role`, `perms`	As above
`lang`	The person's spoken language code, optional
`exp`, `iat`, `nbf`	Unix seconds. Default life 2 hours, at most 24 hours. 30 seconds of clock difference is allowed.
`jti`	A unique id

ttl in the request is in seconds, from 1 to 86,400, default 7,200.

What a token does at the door#

A good token admits the person to its room whatever the room's privacy, and without waiting for the host. A closed room, a full room or a room outside its nbf and exp still refuses. The call page reads ?token= from the address, keeps it for the tab and removes it from the address bar.

Check a token yourself#

Ask Meet:

bash

curl "https://meet.respiresoft.com/api/v1/meeting-tokens/verify" \
  -H "Authorization: Bearer $MEET_API_KEY" -H "Content-Type: application/json" \
  -d '{"token": "<meeting token>", "room": "order-1042"}'

Or verify offline with the public keys at https://meet.respiresoft.com/.well-known/meet-jwks.json:

import { createRemoteJWKSet, jwtVerify } from 'jose';

const jwks = createRemoteJWKSet(new URL('https://meet.respiresoft.com/.well-known/meet-jwks.json'));
const { payload } = await jwtVerify(token, jwks, { issuer: 'meet', audience: 'meet-room' });
if (payload.room !== 'order-1042') throw new Error('wrong room');

The Node and Python SDKs have Meet.tokens.verify that does this for you. Keys can rotate. Tokens made before a rotation stay valid until they expire, because the old public key is kept in the JWKS.