Token source #787

pblazej · 2025-09-16T12:03:04Z

Incarnation of:

Key differences:

Mostly leverages Swift-native approach (protocols + default impl)
Caching is opt-in wrapper (which could be extended to Keychain tho)

pblazej · 2025-09-16T12:04:25Z

Sources/LiveKit/Types/RoomConfiguration.swift

I haven't pushed the respective proto, it does not provide any kind of "validation" for the payload keys, etc.

Sources/LiveKit/Types/RoomConfiguration.swift

1egoman

Looks pretty good to me! I'm not going to be able to comment on some of the swift specific things being done, hopefully others can weigh in on that stuff.

Sources/LiveKit/Core/Room.swift

Sources/LiveKit/Auth/ConnectionCredentials.swift

pblazej · 2025-09-18T12:43:03Z

There will be some renaming to TokenSource and TokenSource.Endpoint as discussed with JS.

pblazej · 2025-09-19T07:19:39Z

Sources/LiveKit/Auth/Sandbox.swift

Moved it to a separate file for visibility.

pblazej · 2025-09-19T08:36:47Z

Added JWT support (if we really want it 👍)

Sources/LiveKit/Auth/TokenSource.swift

bcherry · 2025-09-22T21:47:46Z

Sources/LiveKit/Auth/Sandbox.swift

+
+/// `Sandbox` queries LiveKit Sandbox token server for credentials,
+/// which supports quick prototyping/getting started types of use cases.
+/// - Warning: This token endpoint is **INSECURE** and should **NOT** be used in production.


add the url https://cloud.livekit.io/projects/p_/sandbox/templates/token-server

bcherry · 2025-09-22T21:48:55Z

Sources/LiveKit/Auth/TokenSource.swift

+
+/// Protocol for types that can provide connection credentials.
+/// Implement this protocol to create custom credential providers (e.g., fetching from your backend API).
+public protocol TokenSource: Sendable {


i think we'll need to expand this docstring to explain the whole system, since it seem like the entrypoint where people will encounter tokens for the first time (on the params to the room connect method)

pblazej · 2025-09-25T13:56:46Z

Not sure about the final form (stateless/stateful), depends on JS impl as well 👍

xianshijing-lk

some thoughts from a quick glance, pretty solid code in general.

xianshijing-lk · 2025-09-29T22:11:54Z

Sources/LiveKit/Auth/Sandbox.swift

+/// `Sandbox` queries LiveKit Sandbox token server for credentials,
+/// which supports quick prototyping/getting started types of use cases.
+/// - Warning: This token endpoint is **INSECURE** and should **NOT** be used in production.
+public struct Sandbox: TokenEndpoint {


Nit, is this like mostly for prototyping ?

I am wondering if we should name it as LiveKitSandbox ? so that it will be more explicit. And we can use similar approaches for other prototype APIs.

Sources/LiveKit/Auth/TokenSource.swift

xianshijing-lk · 2025-09-29T23:01:30Z

Sources/LiveKit/Auth/TokenSource.swift

+// MARK: - Cache
+
+/// `CachingTokenSource` handles caching of credentials from any other `TokenSource` using configurable store.
+public actor CachingTokenSource: TokenSource, Loggable {


This looks like a TokenManager to me :)

We can try to resolve naming in JS first to avoid back-and-forth 🥲

xianshijing-lk · 2025-09-30T06:15:35Z

Sources/LiveKit/Auth/TokenSource.swift

+
+/// Protocol for abstract store that can persist and retrieve a single cached credential pair.
+/// Implement this protocol to create custom store implementations e.g. for Keychain.
+public protocol TokenStore: Sendable {


Are we expecting the advanced users to extend this TokenStore protocol ?

Any reason that a persistent store might not meet all the needs ?

It might just be me, I wonder whyTokenStore is tied to one credential, will it be a valid use case that a token needs to be refreshed since a session life is long ? in that case, we might want to update a tokenStore rather than re-creating a new one ? (it might just make things a bit less error prone for the long term)

cc @lukasIO @1egoman

on an ongoing session tokens are automatically refreshed by the server and sent down to provide support for reconnects.

pblazej · 2025-09-30T07:06:22Z

@xianshijing-lk thanks for all the great feedback, there's a slightly longer discussion on the JS PR already, it's hard to keep'em in sync: livekit/client-sdk-js#1645

# Conflicts: # Package.swift # [email protected]

This reverts commit 6b47bb2.

Sources/LiveKit/Auth/Sandbox.swift

davidliu · 2025-10-03T10:34:49Z

Sources/LiveKit/Auth/TokenSource.swift

+            case participantIdentity = "participant_identity"
+            case participantMetadata = "participant_metadata"
+            case participantAttributes = "participant_attributes"
+            case roomConfiguration = "room_configuration"


I think this should be roomConfig/room_config:

https://github.com/livekit/cloud-api-server/blob/b9804fc398beec24a335351bbaa19e5629eda54c/pkg/service/sandbox.go#L97

Good point, I still need to move to protobufs for serialization - that's fixed there 👍

I think I'll finally go for some equivalent of your ProtoConverterTest (that does not exist for Swift yet) vs exposing protobufs.

This needs a separate ticket as the approach is unclear (reflection, etc.)

pblazej · 2025-10-03T12:20:12Z

Sources/LiveKit/Token/TokenSource.swift

+    /// - Configuring recording or streaming options
+    ///
+    /// - SeeAlso: [Room Configuration Documentation](https://docs.livekit.io/home/get-started/authentication/#room-configuration) for more info.
+    public let roomConfiguration: RoomConfiguration?


JS diff: skips agentName/agentMetadata as it's still nested inside RoomConfiguration.agents and can be injected from the upcoming session...

# Conflicts: # Package.swift # [email protected] # Tests/LiveKitTestSupport/TokenGenerator.swift

pblazej · 2025-10-07T07:57:51Z

Sources/LiveKit/Token/TokenSource.swift

+/// - ``EndpointTokenSource``: For custom backend endpoints using LiveKit's JSON format
+/// - ``CachingTokenSource``: For caching credentials (or use the `.cached()` extension)
+public protocol TokenSourceConfigurable: Sendable {
+    func fetch(_ options: TokenRequestOptions) async throws -> TokenSourceResponse


TokenRequestOptions? is also an option here as mentioned above, similarly to ... connectOptions: ConnectOptions? = nil, roomOptions: RoomOptions? = nil

I think at least for the sandbox token server the options would be required?

Technically, I don't think so (but it obfuscates the intention)

xianshijing-lk

from a quick look, lgtm

pblazej · 2025-10-08T08:46:17Z

@hiroshihorie @davidliu as we won't integrate that into the Room (could be internal as well) let's just make sure it's acceptable for agents and move on.

I think Android and Swift are almost identical atm, really easy to compare and follow, left some minor comments on Android.

xianshijing-lk · 2025-10-10T23:10:49Z

Is this ready to land ? Please let me know if you need help on the review or ping other reviewers

Thanks

pblazej commented Sep 16, 2025

View reviewed changes

pblazej requested review from 1egoman, davidliu, hiroshihorie and lukasIO September 16, 2025 12:07

pblazej commented Sep 16, 2025

View reviewed changes

Sources/LiveKit/Types/RoomConfiguration.swift Show resolved Hide resolved

1egoman reviewed Sep 16, 2025

View reviewed changes

Sources/LiveKit/Core/Room.swift Outdated Show resolved Hide resolved

Sources/LiveKit/Auth/ConnectionCredentials.swift Outdated Show resolved Hide resolved

1egoman reviewed Sep 16, 2025

View reviewed changes

Sources/LiveKit/Auth/ConnectionCredentials.swift Outdated Show resolved Hide resolved

pblazej force-pushed the blaze/connection-provider branch from 901e390 to 84a6093 Compare September 17, 2025 08:32

pblazej changed the title ~~Credential providers~~ Token source Sep 19, 2025

pblazej commented Sep 19, 2025

View reviewed changes

Sources/LiveKit/Auth/Sandbox.swift

Copy link

Contributor Author

pblazej Sep 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moved it to a separate file for visibility.

hiroshihorie reacted with thumbs up emoji

bcherry reviewed Sep 22, 2025

View reviewed changes

Sources/LiveKit/Auth/TokenSource.swift Outdated Show resolved Hide resolved

bcherry reviewed Sep 22, 2025

View reviewed changes

Sources/LiveKit/Auth/TokenSource.swift Outdated Show resolved Hide resolved

bcherry reviewed Sep 22, 2025

View reviewed changes

Sources/LiveKit/Auth/TokenSource.swift Outdated Show resolved Hide resolved

bcherry reviewed Sep 22, 2025

View reviewed changes

pblazej force-pushed the blaze/connection-provider branch from e27bd11 to 6b47bb2 Compare September 24, 2025 13:26

xianshijing-lk reviewed Sep 29, 2025

View reviewed changes

xianshijing-lk reviewed Sep 30, 2025

View reviewed changes

pblazej added 7 commits October 2, 2025 10:10

Basic providers with cache

26a4490

Split token server

b0cf3a7

Pass options

d88c2fb

Expose RoomConfiguration (without pb)

5aacd73

Add some tests

b7e999e

Cmts

e311976

Extract storage

894d24e

pblazej added 5 commits October 2, 2025 10:10

JWT

3d45795

# Conflicts: # Package.swift # [email protected]

Filter

aa2f08c

Keys

8673296

Mutable variant with setRequest

748ddd6

Revert "Mutable variant with setRequest"

0c89008

This reverts commit 6b47bb2.

pblazej force-pushed the blaze/connection-provider branch from 51915ab to 0c89008 Compare October 2, 2025 08:10

pblazej added 2 commits October 2, 2025 13:14

Remove Room integration

22f8d77

WIP

eea7c26

davidliu reviewed Oct 3, 2025

View reviewed changes

Sources/LiveKit/Auth/Sandbox.swift Outdated Show resolved Hide resolved

davidliu reviewed Oct 3, 2025

View reviewed changes

pblazej added 4 commits October 3, 2025 13:11

Move, fix serialization

b57e454

Fix tests

71fe3dd

Move

4bbdca8

Comments

6ce5ad8

pblazej requested review from 1egoman, bcherry and davidliu October 3, 2025 12:13

pblazej commented Oct 3, 2025

View reviewed changes

pblazej requested a review from xianshijing-lk October 3, 2025 12:20

Fix tests

6a4474a

pblazej requested review from davidzhao and xianshijing-lk and removed request for xianshijing-lk October 3, 2025 12:24

Merge branch 'main' into blaze/connection-provider

86a445b

# Conflicts: # Package.swift # [email protected] # Tests/LiveKitTestSupport/TokenGenerator.swift

pblazej commented Oct 7, 2025

View reviewed changes

Move tests

6feec3e

pblazej force-pushed the blaze/connection-provider branch from d44e893 to 6feec3e Compare October 7, 2025 08:05

xianshijing-lk approved these changes Oct 7, 2025

View reviewed changes

Token source #787

Are you sure you want to change the base?

Token source #787

Uh oh!

Conversation

pblazej commented Sep 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

1egoman left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pblazej commented Sep 18, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pblazej commented Sep 19, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pblazej commented Sep 25, 2025

Uh oh!

xianshijing-lk left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pblazej commented Sep 30, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pblazej Oct 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xianshijing-lk left a comment

Choose a reason for hiding this comment

Uh oh!

pblazej commented Oct 8, 2025

Uh oh!

xianshijing-lk commented Oct 10, 2025

Uh oh!

Reviewers

Assignees

Labels

pblazej commented Sep 16, 2025 •

edited

Loading

pblazej Oct 8, 2025 •

edited

Loading