Transport Security
HTTPS Requirement
The SDK requires a secure context (HTTPS orlocalhost) to function. WebRTC APIs such as RTCPeerConnection and getUserMedia are not available in insecure contexts.
WebSocket Security
The SDK retrieves the WebSocket URI of the SIP server from the endpoint configuration. Use a WSS (WebSocket Secure) URI. It encrypts all SIP signaling traffic with TLS. The SDK doesn’t check the scheme, so make sure that the configuration uses thewss:// scheme.
Media Encryption
WebRTC media streams (audio) are encrypted using DTLS-SRTP (Datagram Transport Layer Security — Secure Real-time Transport Protocol). DTLS handles the key exchange, and SRTP encrypts the audio data. The browser’s WebRTC implementation enforces this, so no additional configuration is required.Configuration Fetch
Duringconnect(), the SDK sends an HTTPS request to the endpointUrl. The response contains SIP credentials, the SIP server address, and session parameters. Because the response contains authentication credentials, use an HTTPS endpointUrl. The SDK doesn’t enforce HTTPS. It sends the request to the URL exactly as you provide it.
Credential Handling
SIP Credentials
The SDK fetches SIP credentials from the Cognigy backend through theendpointUrl during connect(). The credentials are:
- Provided by the Cognigy backend.
- Managed internally by the SDK. Your application code doesn’t handle them.
- Used only for SIP registration and call signaling.
User Identification
The optionaluserId parameter is used for session identification only. The SDK uses it as part of the SIP identity (SIP URI). If you don’t provide a userId, the SDK generates one.
Network Security
Firewall Configuration
The SDK requires the following network access:Best Practices
- Serve your application over HTTPS in production. WebRTC APIs require a secure context.
- Don’t log SIP credentials. The SDK handles credentials internally. Avoid intercepting or logging them.
- Don’t pass PII as
userId. Use an opaque session identifier instead.