Authentication & Tokens

The SDK works with two types of token:

• Management tokens authenticate your server-side API calls. The client generates and refreshes them automatically.
• Participant tokens authorize a client application to join a room. You generate them on your server and pass them to the client.

Both are JSON Web Tokens (JWTs) signed locally with your secret, so generating one requires no network request.

Management tokens

Construct the client with your credentials and every request is authenticated automatically:

Node.js

const client = new VideoSDK({ apiKey, secret });

Go

client, err := videosdk.NewClient(videosdk.WithAPIKey(apiKey), videosdk.WithSecret(secret))

Rust

let client = Client::builder().api_key(api_key).secret(secret).build()?;

The token is sent as a raw JWT in the Authorization header, with no Bearer prefix.

Participant tokens

Generate a participant token on your backend and pass it to the client SDK to join a room. Use the access-token builder:

Node.js

const token = client
  .accessToken()
  .setParticipant("user-123")
  .grant(Grant.AllowJoin, Grant.AllowMod)
  .forRoom("abcd-efgh-ijkl")
  .expiresIn("2h")
  .toJwt();

Go

b, err := client.AccessToken()
token, err := b.
	SetParticipant("user-123").
	Grant(videosdk.GrantAllowJoin, videosdk.GrantAllowMod).
	ForRoom("abcd-efgh-ijkl").
	ExpiresIn(2 * time.Hour).
	ToJWT()

Rust

let token = client
    .access_token()?
    .set_participant("user-123")
    .grants([Grant::AllowJoin, Grant::AllowMod])
    .for_room("abcd-efgh-ijkl")
    .expires_in(Duration::from_secs(2 * 60 * 60))
    .to_jwt()?;

Each method sets one property of the token: setParticipant the participant id, grant the permissions, forRoom an optional room scope, and expiresIn the expiry. toJwt then signs it with your secret and returns the token string. To build a management token instead of a participant token, replace forRoom with forApi / ForAPI.

Grants control what the participant may do:

Grant	Meaning
AllowJoin	Join the meeting directly.
AskJoin	Request to join. A host admits them.
AllowMod	Moderate others: toggle their mic/camera, remove them.

Without a grant, the token defaults to allow_join and allow_mod.

For a full explanation of participant permissions and join modes, see Permissions and modes.

Generate a token directly

Skip the builder when you just need a management token:

Node.js

const apiToken = client.generateToken({ expiresIn: "1h" });

Go

apiToken, err := client.GenerateToken()

Rust

let api_token = client.generate_token()?;

Verify a token

Returns the decoded claims, or an authentication error if the token is invalid or expired:

Node.js

const claims = client.verifyToken(token);

Go

claims, err := client.VerifyToken(token)

Rust

let claims = client.verify_token(&token)?;

The decoded payload contains:

Field	Type	Description
apikey	string	The API key the token was signed for.
permissions	string[]	Granted permissions (allow_join, allow_mod, …).
roles	string[]	Token roles assigned to the token.
version	number	Token schema version.
iat	number	Issued-at time (epoch seconds).
exp	number	Expiry time (epoch seconds).

Use a pre-generated token

Pass a token you already hold. The client uses it as-is and will not refresh it, so prefer an API key + secret for anything long-lived:

Node.js

const client = new VideoSDK({ token });

Go

client, err := videosdk.NewClient(videosdk.WithToken(token))

Rust

let client = Client::builder().token(token).build()?;

tip

Paste any token into jwt.io to inspect its claims. For the full token model, see the authentication guide.