> Source: https://meetrix.io/blogs/jwt-jitsi-integration/ > Markdown copy of that page. Cite the URL above, not this file. IAM & Security # Integration of JWT with Jitsi [By Hiruna Kumara](https://meetrix.io/blogs/authors/hiruna-kumara/) • September 2, 2026 • 12 min read ## Introduction Security of data on the internet has been a prevalent concern in recent years, as with increased advancements comes the increased risk of privacy breaches. Jitsi, an open-source video conferencing platform, is renowned for its security measures and often used to conduct meetings of a sensitive nature as a result. This is possible because of the JWT integration in place. JWT is one of several [authentication methods Jitsi supports](https://meetrix.io/blogs/jitsi-auth-methods/), alongside Secure Domain, LDAP, and SSO, and it's the one Meetrix recommends for most deployments. This article aims to break down the steps you can take to integrate JWT into Jitsi on your own servers. #### Prerequisites Before moving into the integration of JWT with Jitsi, you need to have a working Jitsi setup. If you do not have it already, you can set it up first or we can help you. Kindly email hello@meetrix.io for further details. ## What is JWT and why use it with Jitsi JSON Web Token - referred to in mainstream as JWT - is a dense, URL-safe means of representing the transfer of claims between two parties. It's commonly used for authentication and authorization purposes. JWT can be used to monitor access to video conferences on Jitsi as well as implement custom roles and permissions. It also enforces authentication upon users for a more streamlined and secure experience. #### Security Benefits JWT integration with Jitsi provides several key security advantages: - Controlled access to meeting rooms - User authentication and authorization - Custom role-based permissions - Token expiration for time-limited access - Secure claim verification You can engage in the following steps in order to integrate JWT with Jitsi: ## How to integrate JWT with Jitsi ### Important Note For your convenience, "jitsi-meet.example.com" will be used as the domain throughout this blog. Please replace it with your domain and make changes accordingly. 1 Change prosody config file Navigate to the [prosody](https://prosody.im/doc/configure) configuration file located at: `/etc/prosody/conf.d/jitsi-meet.example.com.cfg.lua` Add app\_id and app\_secret and save them: VirtualHost "jitsi-meet.example.com" authentication = "token"; app\_id = "your\_app\_id"; app\_secret = "your\_app\_secret"; allow\_empty\_token = false; Add/uncomment token verification plugin inside the modules enabled in Component section: Component "conference.jitsi-meet.example.com" "muc" modules\_enabled = { "token\_verification"; } 2 Configure Jicofo's moderator handling Prosody's `token_verification` module (added above) checks whether a request carries a valid token, but Jicofo separately decides who becomes the room's moderator. By default, Jicofo makes whoever creates the room an owner regardless of what the token says. To make your JWT's `moderator` claim actually control that, open Jicofo's config file, typically `/etc/jitsi/jicofo/jicofo.conf`, and set `enable-auto-owner` to `false` under the `conference` block: jicofo { conference { enable-auto-owner = false } } Jicofo's own `authentication` block can stay disabled, Prosody is already enforcing the token check at the XMPP layer. This one setting only changes who Jicofo treats as the room owner once a token is accepted. 3 Restart services After making the configuration changes, restart both prosody and jicofo: sudo systemctl restart prosody.service sudo systemctl restart jicofo.service ## Generate a JWT token 1 Access JWT.io Go to [https://jwt.io](https://jwt.io) to build and verify a token by hand. If you're wiring this into an app rather than testing manually, our [guide to generating a JWT token programmatically](https://meetrix.io/blogs/create-jwt-token/) covers doing this server-side instead. You will find three segments: **HEADER**, **PAYLOAD** and **VERIFY SIGNATURE** 2 Configure Header **HEADER:** ALGORITHM & TOKEN TYPE are included. Leave it as it is. 3 Configure Payload **PAYLOAD:** Contains information about the entity and additional metadata. Below is an example of a payload: { "context": { "user": { "avatar": "your\_client\_avatar\_url", "name": "your\_client\_name", "email": "your\_client\_email", "moderator": true } }, "aud": "jitsi", "iss": "your\_app\_id", "sub": "jitsi-meet.example.com", "room": "\*", "nbf": 1691498815, "exp": 1692498815 } #### Client data: - **avatar** - add the URL of your client avatar - **name** - name of your client - **email** - email of your client #### Application data: - **iss** - Your app\_id (Added in prosody configuration file) - **sub** - Your xmpp domain (ex: jitsi-meet.example.com) - **exp** - Your token expiration date in unix timestamp standard - **aud** - Specifies the intended recipient of the token (the audience) - **nbf** - The time before which the token is not valid in unix timestamp standard - **room** - Which rooms will be allowed by the token ('\*' will make this token suitable for all the rooms) - **moderator** - Whether to give moderator privilege or not to the user (requires the Jicofo `enable-auto-owner` setting from step 2 above, otherwise Jicofo ignores this claim) 4 Configure Signature **VERIFY SIGNATURE:** Add your app\_secret here ## Test the meeting 1 Copy the generated token Copy the generated token (TOKEN) from [https://jwt.io](https://jwt.io) 2 Initiate meeting with token Now initiate a meeting on Jitsi Meet by sending the generated TOKEN with the meeting URL: https://jitsi-meet.example.com/roomName?jwt=TOKEN ## Conclusion This process is uncomplicated and results in an added layer of security to your meetings on Jitsi, which increases authenticity as well as ensures the safety of the data shared within meetings. JWT is among some of the most optimal security tools available in the market. Others that can be integrated into Jitsi include Secure Domain, LDAP, and [Single Sign-On via Keycloak](https://meetrix.io/blogs/jitsi-keycloak-sso/). Your meetings on Jitsi are only a few straightforward steps away from being fully secured. If you're deploying Jitsi at any real scale, it's also worth checking how JWT-gated rooms hold up under [Jitsi's participant limits](https://meetrix.io/blogs/jitsi-1000-users-limit/) before you finalize your setup. #### Additional Security Considerations While JWT provides excellent security for Jitsi meetings, consider implementing these additional measures: - Regular token rotation and expiration policies - Secure storage of app\_secret credentials - Monitoring and logging of authentication attempts - Integration with existing identity management systems ## Frequently Asked Questions What is Jitsi JWT authentication? Jitsi JWT authentication uses signed JSON Web Tokens to control who can join a Jitsi Meet room. Prosody verifies the token's signature and claims before letting a client into the conference, so only requests carrying a valid token from your app get through. How do I enable JWT authentication in Jitsi Meet? Set authentication = "token" and add your app\_id and app\_secret to the VirtualHost block in jitsi-meet.example.com.cfg.lua, enable the token\_verification module on the MUC component, then restart prosody. Full steps are above. Is JWT the same as Jitsi's Secure Domain authentication? No. Secure Domain checks a username and password against Prosody's local user list and is considered legacy. JWT verifies a signed token issued by your own backend, which makes it the better fit for app-integrated meetings and is the method Meetrix recommends by default. Can I use LDAP or single sign-on instead of JWT? Yes. Jitsi also supports LDAP and SSO via an external identity provider, though LDAP integration is less mature than JWT. See our full breakdown of Jitsi's authentication methods for how each one compares. Where do I generate a JWT for testing Jitsi Meet? jwt.io is fine for manually testing a token against the payload shown above. For production, generate tokens server-side with a JWT library, our create-jwt-token guide walks through doing this programmatically instead of by hand. ## Need Help with Jitsi JWT Integration? Our team at Meetrix can help you implement secure JWT authentication for your Jitsi deployment. Get professional support for enterprise-grade video conferencing security. [Contact Our Experts](https://meetrix.io/contact-us) Meetrix Store Jitsi Meet Self-hosted video calls for 50 to 500 users [Deploy it](https://meetrix.io/store/jitsi-meet/) Meetrix Store New Deploy what this guide covers, pre-configured. - [Jitsi Meet Self-hosted video calls for 50 to 500 users](https://meetrix.io/store/jitsi-meet/) - [Coturn TURN/STUN for WebRTC, no per-minute relay fees](https://meetrix.io/store/coturn/) - [Mattermost Team chat, a self-hosted Slack alternative](https://meetrix.io/store/mattermost/) - [RustDesk Remote desktop AMI, a TeamViewer alternative](https://meetrix.io/store/rustdesk/) - [Mailcow Business email on your own domain](https://meetrix.io/store/mailcow/) - [Listmonk Newsletters with no per-subscriber fees](https://meetrix.io/store/listmonk/) [Browse all products](https://meetrix.io/store/)