Introduction

Security of data on the internet has been a prevalent concern in recent years, as with increased advancements comes the increased risk of privacy breaches. Jitsi, an open-source video conferencing platform, is renowned for its security measures and often used to conduct meetings of a sensitive nature as a result. This is possible because of the JWT integration in place. JWT is one of several authentication methods Jitsi supports, alongside Secure Domain, LDAP, and SSO, and it's the one Meetrix recommends for most deployments. This article aims to break down the steps you can take to integrate JWT into Jitsi on your own servers.

Prerequisites

Before moving into the integration of JWT with Jitsi, you need to have a working Jitsi setup. If you do not have it already, you can set it up first or we can help you. Kindly email hello@meetrix.io for further details.

What is JWT and why use it with Jitsi

JSON Web Token - referred to in mainstream as JWT - is a dense, URL-safe means of representing the transfer of claims between two parties. It's commonly used for authentication and authorization purposes. JWT can be used to monitor access to video conferences on Jitsi as well as implement custom roles and permissions. It also enforces authentication upon users for a more streamlined and secure experience.

Security Benefits

JWT integration with Jitsi provides several key security advantages:

  • Controlled access to meeting rooms
  • User authentication and authorization
  • Custom role-based permissions
  • Token expiration for time-limited access
  • Secure claim verification

You can engage in the following steps in order to integrate JWT with Jitsi:

How to integrate JWT with Jitsi

Important Note

For your convenience, "jitsi-meet.example.com" will be used as the domain throughout this blog. Please replace it with your domain and make changes accordingly.

1 Change prosody config file

Navigate to the prosody configuration file located at: /etc/prosody/conf.d/jitsi-meet.example.com.cfg.lua

Add app_id and app_secret and save them:

VirtualHost "jitsi-meet.example.com"
    authentication = "token";
    app_id = "your_app_id";
    app_secret = "your_app_secret";
    allow_empty_token = false;

Add/uncomment token verification plugin inside the modules enabled in Component section: 

Component "conference.jitsi-meet.example.com" "muc"
    modules_enabled = {
        "token_verification";
    }
2 Configure Jicofo's moderator handling

Prosody's token_verification module (added above) checks whether a request carries a valid token, but Jicofo separately decides who becomes the room's moderator. By default, Jicofo makes whoever creates the room an owner regardless of what the token says. To make your JWT's moderator claim actually control that, open Jicofo's config file, typically /etc/jitsi/jicofo/jicofo.conf, and set enable-auto-owner to false under the conference block: 

jicofo {
    conference {
        enable-auto-owner = false
    }
}

Jicofo's own authentication block can stay disabled, Prosody is already enforcing the token check at the XMPP layer. This one setting only changes who Jicofo treats as the room owner once a token is accepted.

3 Restart services

After making the configuration changes, restart both prosody and jicofo: 

sudo systemctl restart prosody.service
sudo systemctl restart jicofo.service

Generate a JWT token

1 Access JWT.io

Go to https://jwt.io to build and verify a token by hand. If you're wiring this into an app rather than testing manually, our guide to generating a JWT token programmatically covers doing this server-side instead.

You will find three segments: HEADER, PAYLOAD and VERIFY SIGNATURE

2 Configure Header

HEADER: ALGORITHM & TOKEN TYPE are included. Leave it as it is.

3 Configure Payload

PAYLOAD: Contains information about the entity and additional metadata. Below is an example of a payload: 

{
  "context": { 
    "user": {
      "avatar": "your_client_avatar_url",
      "name": "your_client_name",
      "email": "your_client_email",
      "moderator": true
    }
  },
  "aud": "jitsi",
  "iss": "your_app_id",
  "sub": "jitsi-meet.example.com",
  "room": "*",
  "nbf": 1691498815,
  "exp": 1692498815
}

Client data:

  • avatar - add the URL of your client avatar
  • name - name of your client
  • email - email of your client

Application data:

  • iss - Your app_id (Added in prosody configuration file)
  • sub - Your xmpp domain (ex: jitsi-meet.example.com)
  • exp - Your token expiration date in unix timestamp standard
  • aud - Specifies the intended recipient of the token (the audience)
  • nbf - The time before which the token is not valid in unix timestamp standard
  • room - Which rooms will be allowed by the token ('*' will make this token suitable for all the rooms)
  • moderator - Whether to give moderator privilege or not to the user (requires the Jicofo enable-auto-owner setting from step 2 above, otherwise Jicofo ignores this claim)
4 Configure Signature

VERIFY SIGNATURE: Add your app_secret here

Test the meeting

1 Copy the generated token

Copy the generated token (TOKEN) from https://jwt.io

2 Initiate meeting with token

Now initiate a meeting on Jitsi Meet by sending the generated TOKEN with the meeting URL: 

https://jitsi-meet.example.com/roomName?jwt=TOKEN

Conclusion

This process is uncomplicated and results in an added layer of security to your meetings on Jitsi, which increases authenticity as well as ensures the safety of the data shared within meetings. JWT is among some of the most optimal security tools available in the market. Others that can be integrated into Jitsi include Secure Domain, LDAP, and Single Sign-On via Keycloak. Your meetings on Jitsi are only a few straightforward steps away from being fully secured. If you're deploying Jitsi at any real scale, it's also worth checking how JWT-gated rooms hold up under Jitsi's participant limits before you finalize your setup.

Additional Security Considerations

While JWT provides excellent security for Jitsi meetings, consider implementing these additional measures:

  • Regular token rotation and expiration policies
  • Secure storage of app_secret credentials
  • Monitoring and logging of authentication attempts
  • Integration with existing identity management systems

Frequently Asked Questions

What is Jitsi JWT authentication?

Jitsi JWT authentication uses signed JSON Web Tokens to control who can join a Jitsi Meet room. Prosody verifies the token's signature and claims before letting a client into the conference, so only requests carrying a valid token from your app get through.

How do I enable JWT authentication in Jitsi Meet?

Set authentication = "token" and add your app_id and app_secret to the VirtualHost block in jitsi-meet.example.com.cfg.lua, enable the token_verification module on the MUC component, then restart prosody. Full steps are above.

Is JWT the same as Jitsi's Secure Domain authentication?

No. Secure Domain checks a username and password against Prosody's local user list and is considered legacy. JWT verifies a signed token issued by your own backend, which makes it the better fit for app-integrated meetings and is the method Meetrix recommends by default.

Can I use LDAP or single sign-on instead of JWT?

Yes. Jitsi also supports LDAP and SSO via an external identity provider, though LDAP integration is less mature than JWT. See our full breakdown of Jitsi's authentication methods for how each one compares.

Where do I generate a JWT for testing Jitsi Meet?

jwt.io is fine for manually testing a token against the payload shown above. For production, generate tokens server-side with a JWT library, our create-jwt-token guide walks through doing this programmatically instead of by hand.

Need Help with Jitsi JWT Integration?

Our team at Meetrix can help you implement secure JWT authentication for your Jitsi deployment. Get professional support for enterprise-grade video conferencing security.

Contact Our Experts

© 2026 Meetrix, All rights reserved.