Server Integration

Your application server protects application secrets, checks business permissions, and requests short-lived room credentials for devices. Devices should not call the Token service directly or hold application secrets; they only receive peer_id and token from your application server.

Authentication

The signing method is the same as Tange Cloud OpenAPI server-side signing. See 服务端API接口签名算法Demo.

Issue Room Credentials

Request peer_id and token from the Token service:

POST https://api-tirtc.tange365.com/v1/token/room
Content-Type: application/json
Authorization: TGV1-HMAC-SHA256 ...
X-Tg-App-Id: {AppId}

Request body:

{
  "room_id": "order-20260611-001",
  "device_id": "device-001"
}

Example response:

{
  "peer_id": "room_peer_order_20260611_001_device_001",
  "token": "v1.{claimB64}.{sig}"
}

peer_id is the target identifier delivered to the device. The device should pass it unchanged to the TiRTC TiRtcWhipConnect API. Do not parse, derive, or rewrite it.

Recommended Server Flow

1. Check the permission relationship among the signed-in user, device, and business room.
2. Call the Token service with server-side credentials.
3. After a successful response, send only peer_id and token to the device.
4. Do not log the full token. Log only room_id, device_id, request time, and error code.
5. If a credential expires or connection fails, request a new token instead of reusing the old one.

Field Rules

Field	Description
room_id	Business logical room ID that identifies the room the device should join. Use a stable and traceable business ID that does not contain sensitive information.
device_id	Unique device identifier and must match the business permission result.
peer_id	Target identifier returned by the Token service and securely delivered by your application server.
token	Short-lived credential that can only be used with the returned peer_id.

Common Errors

HTTP status	Description
400	Invalid request parameters, such as empty room_id or device_id.
401	App authentication failed. Check X-Tg-App-Id, TGV1 signature time, signed headers, and Body SHA-256.
403	The application or device does not have permission to join the room.