Working with Daily meeting tokens

Daily meeting tokens can be used to set options and permissions for users joining a Daily room. Examples of what a token can grant include:

Access to a private room
A preset user name
Permission to initiate screen sharing or recording
Automatic ejection after a set duration

What is a Daily meeting token?

Daily meeting tokens are JSON Web Tokens (JWTs) — strings made up of three base64-encoded parts separated by periods:

Header: algorithm and token type
Payload: claims like expiry, issue time, and room privileges
Signature: the header and payload signed with a secret

The JWT standard is detailed in RFC 7519. An example JWT:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYmYiOjE1NDg3MjE1NjksImV4cCI6MTg2NDA4MTUzOCwiciI6ImhlbGxvIiwibyI6dHJ1ZSwic3MiOnRydWUsImVyIjoibG9jYWwiLCJkIjoiMjVkZjUwNTctZWYwZC00ZDk3LWJkZTYtMGNmMjg3Mjc2Y2JiIiwiaWF0IjoxNTQ4NzIxODMxfQ.mvVciAengBR4xCblhFpo4mKYftQv1skYO4Y6IKr9Zgo

The above token decodes to the following JSON payload:

{
  "nbf": 1548721569,
  "exp": 1864081538,
  "r": "hello",
  "o": true,
  "ss": true,
  "er": "local",
  "d": "25df5057-ef0d-4d97-bde6-0cf287276cbb",
  "iat": 1548721831
}

Self-signed tokens use abbreviated field names. See token property abbreviations for the full list.

Getting a Daily meeting token

A Daily meeting token can be obtained either through the REST API, or by self-signing a JWT with your Daily API key.

Via the REST API

Make a POST request to https://api.daily.co/v1/meeting-tokens with your chosen token properties:

# Create a token for the room specified by DAILY_ROOM_NAME, with an expiry of 1 hour.
curl -H "Content-Type: application/json" \
     -H "Authorization: Bearer $DAILY_API_KEY" \
     -XPOST -d \
     '{"properties":{"room_name":"'`expr $DAILY_ROOM_NAME`'","exp":'`expr  $(date +%s) + 3600`'}}' \
     https://api.daily.co/v1/meeting-tokens

Via self-signing

Tokens can also be self-signed using a JWT library. Example using jsonwebtoken:

import * as jwt from 'jsonwebtoken';

function generateMeetingToken() {
  const payload = {
    r: 'daily-room-name',
    d: 'daily-domain-uuid',
  };
  try {
    const token = jwt.sign(payload, DAILY_API_KEY, { expiresIn: '1h' });
    return token;
  } catch (e) {
    throw new Error(`failed to create self-signed JWT: ${e.toString()}`);
  }
}

Refer to token property abbreviations when composing your payload.

Security considerations

We recommend narrowing the scope and lifetime of your token as much as possible:

Always set an expiry. A token without exp is valid forever.
Specify a room name. A token without r is valid for every room on your domain.

If a Daily-signed token is compromised, the only way to revoke it is to delete the room it was generated for (if you specified one). If a self-signed token is compromised, you can revoke it by regenerating your API key in the Daily dashboard.

Using a Daily meeting token

Pass the token as part of the join() call:

const call = Daily.createCallObject();
call.join({
  token: DAILY_MEETING_TOKEN,
  url: DAILY_ROOM_URL,
});

If a meeting token is invalid, no error is emitted at join time. Privileged operations will simply fail when attempted.

Validating a Daily meeting token

To validate a token via the REST API, make a GET request to https://api.daily.co/v1/meeting-tokens/[DAILY_MEETING_TOKEN]:

curl -H "Content-Type: application/json" \
     -H "Authorization: Bearer $DAILY_API_KEY" \
     https://api.daily.co/v1/meeting-tokens/$DAILY_MEETING_TOKEN

A 200 response includes an object with the token’s properties. If the token is invalid, an error is returned. If you’re using a self-signed token, you can validate claims and signature locally using a JWT library without making an API request.

Architecture & Monitoring

Privacy and Security

Scaling Calls

Features

Working with Daily meeting tokens

What is a Daily meeting token?

Getting a Daily meeting token

Via the REST API

Via self-signing

Security considerations

Using a Daily meeting token

Validating a Daily meeting token

​What is a Daily meeting token?

​Getting a Daily meeting token

​Via the REST API

​Via self-signing

​Security considerations

​Using a Daily meeting token

​Validating a Daily meeting token

What is a Daily meeting token?

Getting a Daily meeting token

Via the REST API

Via self-signing

Security considerations

Using a Daily meeting token

Validating a Daily meeting token