> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vasl.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Keys for streams, SSO for operators, and encryption on the wire.

Close the URLs. A stream key expires. An operator signs in. The media is encrypted on the path that leaves the machine.

## Token auth

Publish and play use short-lived JWT keys. When the appointment ends, the key ends with it. Rotate a key from your app when a person should lose access before the clock runs out. See [REST and webhooks](/api).

## Signed URLs

Signed links expire. Pin a link to an address when the playback should only work from that client. IP rules sit alongside those links for networks you already know.

## SSO and roles

Operators sign in with SAML or OIDC. Roles match the job of the person running the server. Viewers stay on stream keys.

## Encryption

| Path | What protects it |
| - | - |
| Connections you expose | TLS |
| WebRTC media | SRTP |
| HLS segments | AES-128 |

<Card title="Call it from your product" icon="webhook" href="/api">
  Create the stream, hand out the key, and hear when the recording is finished.
</Card>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.