Deploy Your Video Call App | Build a Video Call App Part 7

[@GrantKot]

Hi, is it safe to have the credentials in the turn.json file? Are there any recommendations to handle it more securely, e.g. binding, etc?

[@CloudflareDevelopers]

Hello @GrantKot. Yes in this case since that configuration is needed in the client to initialise the connection - Confidence

[@GrantKot]

@@CloudflareDevelopers ok, i was looking at the doc which is also shown 8:29 "You need to generate short-lived credentials for each TURN user". I also asked my AI a bit lol, I was thinking, maybe it would be better to do this curl thing on the Durable Object so you can give each user a new set of username and credentials with like a ttl within the hour or minute?

[@rafikitechnology]

@CloudflareDevelopers Can these credentials then be made to exist and be visible out in the open where anyone can see them if, for example, the code is stored in a public GitHub repository? In other words, should those credentials generated by the CURL call at the console be kept secret?

[@GrantKot]

@@rafikitechnologyI’m still new to this tech but I would really advise against putting the credential in repo. For my own design I am planning to add a websocket message type to request and return the credentials with somewhat short ttl. If you just put a long lived token out there what’s stopping other people from using it and piggybacking off of your CF bills?