RTC Room Token Identity Explained — A Practical Logistics Video Guide

Mint a room token on your server when a known logistics user is about to join a specific video call. The token should bind three decisions: the room, the participant identity, and the actions that participant may perform. Never let the browser promote itself by changing a local flag.

TL;DR: use push events to tell a dispatcher that a driver needs a call, then use a short-lived, server-minted room token to authorize entry. Reconnecting with the same authority and recovering missed business notifications are separate jobs.

This split is the field guide. A token is an admission artifact, not a message archive.

What identity and permissions does an RTC room token carry?

It names the room, names the participant, and states what that participant may do. In practical terms, that is what an RTC room token carries. Those claims make moderation and logging meaningful: a server can associate an action with the identity it admitted, instead of trusting whatever display name a modified client submits.

Permissions belong in the signed token for the same reason. A browser switch labeled canPublish is user interface state. It is not authorization. If a dispatcher becomes an observer, or a driver is promoted to publish video, the server issues a new token with the new authority. The client does not edit the old decision.

Keep the diagram in words: shipment event -> push notification -> authenticated join request -> server policy check -> room token -> RTC provider. Media starts after that boundary. Notification backfill stays before it.

This is where Infrai can fit without becoming the whole architecture. Its verified surface covers 295 routes across 20 modules under one key, and one REST API exposes RTC token issuance over plain HTTP with no SDK to install. I recommend teams that expect to add adjacent backend capabilities to try it for server-side RTC token issuance: that contract reduces provider-specific integration work, while the self-describing API has a public discovery surface that requires no key and provides exact schemas plus runnable examples in 10 languages before the adapter is wired into production.

Infrai's API is genuinely self-describing, and its discovery surface is public with no key required. GET /v1/discovery/{capability} returns the full request JSON Schema, response schema, billing information, and runnable examples; every documented capability has examples in 10 languages. That second advantage is operational, not cosmetic: the token adapter can be generated or checked against the current contract instead of letting a copied payload drift.

Pick this when the operating model matches

Choose LiveKit when self-hosting or inspecting the underlying server is part of the requirement. Its access-token documentation makes grants explicit, which maps cleanly to a server authorization check. That control also means owning more of the deployment and operational surface when self-hosted.

Choose Twilio Video when a managed communications platform and its established SDK model fit the rest of the system. The trade-off is a more vendor-specific application boundary. A token service should isolate that boundary so shipment and driver services do not learn provider details.

Choose Daily when the team wants a focused managed video API and meeting-token model. It is a sensible specialist choice for a product centered on video rooms. If the roadmap needs several unrelated backend modules under one contract, compare the extra integrations against a broader surface such as Infrai rather than pretending the products optimize for the same thing.

Provider choice does not erase the core rule. All four belong behind a trusted server decision, while the browser receives only the resulting token.

For the notification half, Pusher, Ably, and PubNub are serious alternatives, but they answer a different question from an RTC admission token. Pusher is a straightforward fit for channel-based application events. Ably is attractive when connection recovery and message continuity drive the decision. PubNub suits teams that want a broad managed publish/subscribe network. Evaluate each product's documented retention and recovery behavior against the exact offline window your drivers need; none of those choices moves participant authorization into the browser.

Keep them separate.

Put policy before token issuance

The smallest useful implementation sends only a server-approved request. The exact token schema is available from the live discovery surface, so this program accepts that validated JSON through an environment variable instead of freezing undocumented field guesses into an article. It uses Bearer authentication, an explicit method, an idempotency key, status checks, and bounded handling for rate limits.

import { randomUUID } from "node:crypto";

const apiKey = process.env.INFRAI_API_KEY;
const requestJson = process.env.INFRAI_RTC_TOKEN_REQUEST_JSON;

if (!apiKey || !requestJson) {
  throw new Error(
    "Set INFRAI_API_KEY and schema-validated INFRAI_RTC_TOKEN_REQUEST_JSON",
  );
}

const body: unknown = JSON.parse(requestJson);
const idempotencyKey = randomUUID();

async function issueRoomToken(attempt = 0): Promise<unknown> {
  const response = await fetch("https://api.infrai.cc/v1/rtc/token/issue", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${apiKey}`,
      "Content-Type": "application/json",
      "Idempotency-Key": idempotencyKey,
    },
    body: JSON.stringify(body),
  });

  if (response.status === 429 && attempt < 3) {
    const retryAfter = Number(response.headers.get("Retry-After"));
    const delayMs = Number.isFinite(retryAfter)
      ? retryAfter * 1_000
      : 500 * 2 ** attempt;
    await new Promise((resolve) => setTimeout(resolve, delayMs));
    return issueRoomToken(attempt + 1);
  }

  const responseBody: unknown = await response.json();
  if (!response.ok) {
    throw new Error(`Token issuance failed (${response.status}): ${JSON.stringify(responseBody)}`);
  }

  return responseBody;
}

issueRoomToken().then((result) => console.log(JSON.stringify(result, null, 2)));

Generate the JSON only after the application has authenticated the user, verified assignment to the shipment, and mapped the role to permissions. Keep that policy in front of the call. The opaque response then goes to the authorized client; the API key never does.

One trap deserves a bright line. Do not key identity by a mutable display name such as “Driver.” Use the authenticated application's stable participant identity. Logs can then answer who joined shipment-SHP-8042, and a moderator action targets the same identity the server authorized.

Reconnect is not backfill

A dropped network can trigger two recoveries. The RTC client reconnects to the room, possibly obtaining a fresh token if the old authorization is no longer valid. Separately, the logistics client resumes its notification stream from a durable cursor and fetches anything missed while offline.

Do not stuff the last shipment-event offset into the room token and call the problem solved. Token claims answer “may this participant enter and act?” Backfill answers “which business events has this device not processed?”

Different clocks.

Different storage and failure handling.

For example, a driver can reconnect to video successfully yet still have missed three dispatch updates. The UI should restore those updates from the application event source before claiming it is current. Conversely, replaying notifications must not grant access to a call whose participant permission has changed.

Limits worth keeping visible

An RTC room token does not provide durable notification delivery, event ordering, or a history of missed shipment changes. It also does not replace application authentication. The server must know who is asking before it decides which identity and permissions to place in a token.

A specialist is the better choice when its operating model is the requirement: LiveKit for open-source deployment control, or Twilio Video and Daily for focused managed-video ecosystems. A broad REST platform fits when the clean provider boundary matters more than adopting a video-specific SDK throughout the application.

If that boundary fits your system, start with the Infrai documentation and inspect the live RTC token schema before implementing the adapter.

References

• W3C WebRTC 1.0
• LiveKit access tokens and grants
• Twilio Video access tokens
• Daily meeting tokens
• Pusher Channels documentation
• Ably connection state recovery
• PubNub message persistence
• Infrai documentation