PurpleCallio documentation
Security
PurpleCallio separates credentials by trust boundary: your backend, the participant's browser, and the media relay each receive only the access they need.
API key: server only
Your project API key authorizes creating and managing calls. Never expose it in browser code, a public repository, or a client-side environment variable. Use it only from trusted server code.
Participant access: session only
When a call is created, each participant receives access scoped to that call. Pass only the participant's own access to hosted UI, the React components, or the headless SDK running in their browser.
Dashboard authentication
The dashboard uses its own authenticated session to manage account and project resources. It is separate from both the API key and participant access.
TURN credentials
Media relay (TURN) credentials are time-limited and generated per session using an HMAC-signed shared secret, so a leaked credential stops working after a short expiry window.
Transport and origin security
API and signaling traffic is served over HTTPS/WSS. Configure CORS for your own domains and do not disable certificate validation in production.
Related documentation
Build with PurpleCallio
Explore the documentation to choose hosted UI, React components, or the headless SDK for your integration.