Start here

Credentials and auth

What the App Key, Server Secret and App Certificate do, and which one to use.

Each project has four credentials. Most apps only need the first two.

Credential	Secret?	What it does
App ID	No	Identifies your project.
App Key	No, it ships in your app	Mints room tokens with `X-App-Key`. It can't sign tokens or call the server-to-server API.
Server Secret	Yes	Mints tokens from your backend and signs server-to-server calls.
Callback Secret	Yes	Only for direct engine callbacks. Webhooks you add in the console have their own secret.

Find them under Project Information in the console, where the App Key is labelled AppSign (AppKey).

Which way to join

	App Key	Server Secret	Token v2
Who gets the token	The app, directly from Voxera	Your backend	The app, with a token your backend signed
Backend needed	No	Yes	Yes
Who decides the identity and role	The app	Your backend	Your backend
Best for	Getting started, and apps that accept this tradeoff	Backends that already issue sessions	Apps that want the server to control every join

App Key

The kits use this by default. Pass appId and appKey, and the kit gets its own tokens:

curl -X POST https://stream.zavryn.online/api/v1/token \
  -H "Content-Type: application/json" \
  -H "X-App-Id: YOUR_APP_ID" \
  -H "X-App-Key: YOUR_APP_KEY" \
  -d '{"identity": "user123", "room_name": "room456", "type": "audio_room"}'

The App Key ships in your app, so anyone who extracts it can request a token for any identity in your project. Voxera still enforces server-side rules: a live room only gives the host role to the verified owner, and banned users can't get a token. If a key leaks, rotate it in the console and ship a new build.

Server Secret

Your backend asks for the token and hands it to the app:

// Node.js, on your own server. The Server Secret must never ship in an app.
const response = await fetch("https://stream.zavryn.online/api/v1/token", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-App-Id": process.env.VOXERA_APP_ID,
    "X-App-Secret": process.env.VOXERA_SERVER_SECRET,
  },
  body: JSON.stringify({ identity: "user123", room_name: "room456", type: "live_stream" }),
});
 
const { token, url, user_token, ws_url } = await response.json();

Token v2

Your server signs a short-lived token saying who the user is, which room they may join and whether they may publish. The app joins with that token and holds nothing that can mint for another identity. See Token v2.

Tokens in the room

The response to a mint contains two tokens:

token connects to the room's media.
user_token authorizes in-room requests such as taking a seat. Send it as Authorization: Bearer <user_token>. It's bound to one identity.

The kits handle both for you. See the Token API for the full request and response.