NODE.JS · SERVER

Node.js server SDK

Create the short-lived user tokens your apps need for voice calls, video calls and chat. Published on npm as rtcexpress-server: Node.js 18 or newer, no dependencies, ESM and CommonJS, TypeScript types included.

Where it runs

Your App Secret must stay on your server, and so does this package. Your backend signs the user in, decides which room they may join, and returns a token. The browser or mobile app passes that token to a client SDK (Web, React Native, Flutter, Android).

Install

npm install rtcexpress-server

Create a token endpoint

import { RTCExpressServer } from "rtcexpress-server";

const rtc = new RTCExpressServer({
  appId: process.env.RTC_APP_ID,
  appSecret: process.env.RTC_APP_SECRET,
});

// Example with Express: only signed-in users get a token, for one room.
app.post("/api/rtc-token", requireLogin, async (req, res) => {
  const { token, expiresIn } = await rtc.createToken({
    userId: req.user.id,
    roomId: req.body.roomId, // check the user may join this room first
  });
  res.json({ token, expiresIn });
});

CommonJS works too: const { RTCExpressServer } = require("rtcexpress-server");

Options

Option	Required	Description
`appId`	Yes	Your project's App ID, from the customer console.
`appSecret`	Yes	Your App Secret. Load it from an environment variable or secret store.
`serverUrl`	No	Defaults to `https://api.devsquarelabs.com`.
`timeoutMs`	No	Request timeout. Defaults to 10000.

rtc.createToken({ userId, roomId?, role? }) returns { token, expiresIn }, where expiresIn is in seconds (currently one hour). userId is your own ID for the user; each device in a call needs its own. roomId limits the token to one room and is recommended. role is host, publisher, subscriber or audience, for broadcast-style rooms.

Errors

Failures throw RTCExpressError with a status: 401 wrong App ID or App Secret, 400 missing or invalid values, 429 too many token requests from your server (30 a minute per IP; reuse a token until it is close to expiry), 0 RTCExpress could not be reached (network error or timeout).

import { RTCExpressError } from "rtcexpress-server";

try {
  await rtc.createToken({ userId: "alice" });
} catch (err) {
  if (err instanceof RTCExpressError && err.status === 401) {
    // check RTC_APP_ID / RTC_APP_SECRET
  }
  throw err;
}

Production notes

Keep authorization on your serverNever send the App Secret to a browser or app, and never put it in Git. Check that the signed-in user may join the room before you create a token for it.

Not on Node.js? Call POST /v1/token directly from any backend language.

Continue building

Client SDK guides API reference