Security boundary

Credentials

TOMO_STREAM_API_KEY is a server credential. Store it in a secret manager and send it only from your trusted backend using the x-api-key header.

The browser receives the session’s temporary player connection object:

{
  "signalingPath": "/signaling",
  "room": "stream-session-id",
  "accessToken": "temporary-player-token"
}

Host credentials are injected into the stream-server container and are not returned by the REST API.

Input

The media runtime forwards versioned input packets as opaque data. Apply keyboard, pointer or OS-level events in a separately sandboxed input agent with the minimum privileges required.

Worker isolation

The control plane mounts the Docker socket in the current self-hosted architecture. Treat it as privileged infrastructure: dedicate the worker, restrict network access, enforce TLS and set resource limits for every session container.

Internet deployments

Use HTTPS/WSS, configure TURN, rotate API keys, restrict CORS at the edge when possible, and avoid logging player access tokens.