Credentials and tokens
Keep each credential in its own trust boundary.
| Credential | Holder | Purpose |
|---|---|---|
| Ed25519 private key | Business server | Issue TiRTC-X connection tokens |
| Ed25519 public key | WHIP Service and TiRTC registration | Verify token signatures |
| Device Secret Key | Device secure storage | Prove device identity to TiRTC |
| Connection token | Authorized device | Delegate access to a specific WHIP service until expiry |
Keep private keys in a server-side key management system and out of devices, frontends, logs, and source control. A WHIP Service needs public keys only. Keep the Device Secret Key on the device.
Long-lived delegation token
- The business server signs a connection token with its Ed25519 private key. Until expiry, the token delegates access to a specific WHIP service for a specific device.
- Bind the token to the device ID, service, and complete query. The device can use it only for the matching connection.
- The same token may be used to reconnect while it remains valid.
- Choose an expiry that covers the device's offline recovery period, and provide revocation through device unbinding or Access Key rotation.
- Prefer HTTPS and never place the token in a URL. If a device requires HTTP, use it only on a controlled network path and accept that the token has no transport encryption.
- Keep complete tokens out of logs, metric labels, and error responses.
A device stores only the token returned by the business server; it never stores the signing key or mints new tokens. See Issue connection parameters for the peer_id and token algorithm.
DELETE does not carry the connection token. Identify the session by the unpredictable random session-id in Location, and return 204 No Content for both repeated deletion and unknown IDs so resource existence is not disclosed. Use at least 128 bits of cryptographic randomness; never derive an ID from a sequence, device ID, or another predictable value.
The peer_id query reaches the WHIP Service. Include only required non-secret values and validate lengths, character sets, and allowed values.