Mint short-lived tokens and connect users securely.

Authentication

Alaznah Calling authenticates each mobile client with a short-lived token minted by your backend.

Never ship API keys or secrets inside the app binary.

Flow

End user signs into your app (email, SSO, etc.)
Your backend validates that session
Your backend mints an Alaznah Calling token using credentials from the Developer Console
The SDK calls getAuthToken() whenever it needs to connect (or reconnect)
Signaling accepts the token and binds the session to config.userId

The userId claimed by the token must match CallingClientConfig.userId.

Client configuration

tsx

<CallingProvider
  config={{
    userId: currentUser.id,
    getAuthToken: async () => {
      const res = await fetch('https://api.yourapp.com/calling/token', {
        headers: { Authorization: `Bearer ${sessionToken}` },
      });
      if (!res.ok) throw new Error('Failed to mint calling token');
      const { token } = await res.json();
      return token;
    },
    // signalingUrl omitted → Hosted Signaling default
  }}
/>

Rules of thumb

Return a fresh token on each getAuthToken() call (do not cache forever)
Keep TTL short (minutes, not days)
On 401 / auth errors from signaling, mint again and reconnect
Use a stable, unique userId per end user (the peer dials this id)

Console

Register / sign in at console.alaznah.com
Create a project
Copy App ID / API credentials into your server environment only
Follow the console’s token minting guide for your plan

Exact HTTP shapes for mint endpoints are defined in the console for your account — keep secrets server-side.

Entitlement (commercial)