Your application owns identity, state, and lifecycle around the SFU's media transport. Preserve these boundaries when adapting an example.
Store the SFU App Secret on trusted server infrastructure. In Workers, use a Worker secret. Browsers and devices authenticate to your application backend using credentials scoped to their own responsibilities.
Expose application operations with validated inputs. Avoid an unrestricted SFU proxy that lets a browser select arbitrary sessions, publications, or destructive operations.
WebSocket endpoint credentials are separate from the SFU App Secret. Keep both out of public assets, URLs sent to viewers, and logs.
Check identity and resource ownership before creating, publishing, subscribing, updating permissions, or closing resources. A room name, session ID, track name, or adapter ID is a locator rather than proof of permission.
An operator role also needs application authorization. For device control, the backend can assign a short controller lease and grant canReply only to that selection. Handle lease expiry and revoked access in the application, not just the browser UI.
Follow per-session mutation ordering. Retain work that arrives during an outstanding exchange, and check per-item results before advancing application state.
Decide whether an application keeps its identity while replacing a media connection. Give each connection attempt an ID so old responses cannot alter replacement sessions. Follow the replacement-connection sequence.
Make reconnect visible to the user, bound retries, and provide a recovery action when automatic attempts fail. The correct choice depends on the application: a room can rebuild subscriptions, while a device listener might require an explicit rejoin.
For WebSocket adapters, implement recreation after terminal closure and respect the different ingest and stream reconnect behavior.
Remove unavailable or unauthorized publications from discovery. Retain their resource identifiers privately until required cleanup is complete. Check individual close results and keep unresolved items available for retry.
Decide whether replacement can proceed while old resources remain. Discarding an obsolete connection from application state does not stop SFU forwarding. When you need to stop access, close the affected SFU resources and confirm the result.
Use explicit leave/stop operations and application expiry for abandoned clients. A browser tab may close without sending cleanup. Keep the backend available while retries still need to run.
Set admission limits, operation rates, and resource lifetimes appropriate to your application. An example's room size or controller policy is an application decision. Refer to SFU limits for product constraints.
Use observability to connect API results, endpoint state, and media delivery. Validate authorization and failure paths alongside the successful flow.
The video-room production guide ↗ explains identity and room authorization. The cloud-gaming architecture ↗ shows controller generations and input release. Pocket Radio's architecture ↗ explains device credentials, listener membership, and controller leases.