Architecture and integration

A connection has two phases: business authorization and device connection.

Roles and responsibilities

Role	Responsibility
Business server	Validate business requests, generate peer_id, and issue a reusable delegation token to the authorized device
Tange Platform	Real-time audio and video transport platform
Device	Obtain credentials from the business server, call TiRtcWhipConnect, and capture and play media
WHIP Service	Verify the Bearer token, handle SDP, manage connection resources, and implement business media logic

Service registration

Before deployment, provide the following information to Tange Intelligence:

• A globally unique service_name.
• At least one Access Key ID and Ed25519 public key. Generate the Ed25519 private key and keep it on the business server. The business server uses the private key to sign connection tokens, and the Tange Platform verifies them with the public key.
• A public HTTP or HTTPS WHIP endpoint for every target Region, according to device capabilities.

Available Regions:

Region	Area
cn01	Mainland China
na01	Americas
ea01	Asia
we01	Europe

After registration, Tange Intelligence returns the confirmed service_name, Access Key ID, and Regions.

Device-side testing also requires a device_id and device_secret_key. Contact Tange technical support to obtain them.

The service endpoint must be reachable by devices in the corresponding Region.

peer_id

peer_id identifies the service and business parameters for the device connection:

whips://{service_name}?{query}

Use standard URL encoding and keep the total length at or below 2048 bytes. TiRTC forwards the query to your service. Never include passwords, private keys, or long-lived credentials.

Connection token

After authorizing the device, the business server signs a connection token with its Ed25519 private key and returns it with peer_id to that device. The token binds the device ID, service name, and complete query. The device can use it only for the matching connection and may reuse it for reconnection while it remains valid.

The WHIP Service verifies the token with the registered public key. Keep the signing private key only on the business server; never deliver it to devices or the WHIP Service. See Issue connection parameters for the issuing code.

Server SDK layers

Authentication policy is independent from WHIP acceptance. Authenticate the resource-creation POST, then call WhipAcceptor. The application manages ordinary business resources; whipecho can manage Echo resources.