Issue connection parameters

Before a device connects to a WHIP Service, the business server must authorize access and return a peer_id and connection token for that device.

Issuing requires:

• The registered service_name and Access Key ID.
• The Ed25519 private key paired with the registered public key.
• The authorized TiRTC device ID.
• The query required by the target WHIP Service, or an empty query when none is required.
• A token lifetime suitable for the business offline-recovery period.

Build peer_id

whips://{service_name}?{raw_query}

Use the registered service name and build the query for the current connection target. Omit ? when there is no query. The token scope binds the service name and complete query, so both must remain unchanged after issuing.

Token issuing algorithm

Issue the token with whip-sdk:

Go

import (
    "time"

    "gitlab.tange-ai.com/tirtc-nexus/whip-sdk/go/pkg/tirtcxauth"
)

issuer, err := tirtcxauth.NewEd25519TokenIssuer(map[string]string{
    accessKeyID: ed25519PrivateKey,
})
if err != nil {
    return err
}

token, err := issuer.Issue(
    serviceName,
    accessKeyID,
    deviceID,
    rawQuery,
    30*24*time.Hour,
)
if err != nil {
    return err
}

Python

from tirtcxauth import Ed25519TokenIssuer

issuer = Ed25519TokenIssuer({
    access_key_id: ed25519_private_key,
})

token = issuer.issue(
    service_name,
    access_key_id,
    device_id,
    raw_query,
    30 * 24 * 60 * 60,
)

rawQuery / raw_query must exactly match the complete query in peer_id. Use the Ed25519 private key paired with the registered public key.

Deliver the parameters

Return the matching peer_id and token only to the authorized device. The device passes them as the service_desc and token arguments to TiRtcWhipConnect.

Keep the private key in the business server's key management system. Never deliver it to devices or write it to logs. Complete tokens must also stay out of logs, metric labels, and error responses.