Skip to main content

​
Overview

Ant Media Server supports multiple authentication mechanisms:
  • One-time tokens - Random tokens with expiration
  • JWT tokens - Industry standard JSON Web Tokens
  • TOTP - Time-based One-Time Passwords for subscribers

​
Generate One-Time Token

Generate a random one-time token for a specific stream.
GET /v2/broadcasts/{id}/token
​
string
required
Stream ID to generate token for
​
integer
required
Token expiration time in Unix timestamp (seconds)
​
string
required
Token type: publish or play
​
string
Room ID if token is for a conference room
​
string
Generated token ID
​
string
Stream ID this token is valid for
​
integer
Token expiration timestamp
​
string
Token type (publish/play)

​
Generate JWT Token

Generate a JWT token for a stream. Generally JWT tokens should be generated on the client side.
GET /v2/broadcasts/{id}/jwt-token
​
string
required
Stream ID to generate JWT token for
​
integer
required
Token expiration time in Unix timestamp (seconds)
​
string
required
Token type: publish or play
​
string
Room ID if token is for a conference room
Response: Same as one-time token response.

​
Validate Token

Validate if a token is still valid and not expired.
POST /v2/broadcasts/validate-token
​
string
required
Token ID to validate
​
string
required
Stream ID associated with the token
​
integer
required
Token expiration timestamp
​
string
required
Token type (publish/play)
​
boolean
true if token is valid, false otherwise

​
List Tokens

Get all tokens for a specific stream.
GET /v2/broadcasts/{id}/tokens/list/{offset}/{size}
​
string
required
Stream ID to list tokens for
​
integer
required
Starting point of the list
​
integer
required
Number of tokens to return (max: 50)
Response: Array of token objects.

​
Revoke All Tokens

Remove all tokens associated with a stream.
DELETE /v2/broadcasts/{id}/tokens
​
string
required
Stream ID to revoke tokens for
​
boolean
true if tokens were revoked successfully

​
TOTP Authentication

For subscriber-based authentication, Ant Media Server supports Time-based One-Time Passwords (TOTP).

​
Get TOTP for Subscriber

GET /v2/broadcasts/{id}/subscribers/{subscriberId}/totp
​
string
required
Stream ID
​
string
required
Subscriber ID to generate TOTP for
​
string
Type: publish or play. Used if subscriber is not in database
​
boolean
Indicates if TOTP was generated successfully
​
string
The generated TOTP code (6 digits)

​
How TOTP Works

If the subscriber is registered in the database with a b32Secret:
  • TOTP is generated using the subscriber’s secret
  • Custom expiry period is used if set, otherwise global setting applies
If the subscriber is NOT in the database:
  • Secret is generated from AppSettings: {secretFromSettings} + {subscriberId} + {streamId} + {type} + {padding}
  • Uses global timeTokenPeriod setting

​
Subscriber Authentication Token

Get a JWT authentication token for a subscriber (for push notifications).
GET /v2/push-notification/subscriber-auth-token
​
string
required
Subscriber ID to generate token for
​
integer
Token validity duration in seconds (default: 3600)
​
boolean
Whether token generation succeeded
​
string
The generated JWT token
​
string
Description of the response