Security Best Practices


Security is both critical and essential for building applications. Dolby is committed to building a best-in-class audio/visual communication experience on a reliable and secure platform, and constantly strives to improve product security.

This article describes various aspects of security features and best practices for the Communications APIs platform.


Your credentials

Each application, when created in the dashboard, has a consumer key and a consumer secret. The consumer secret is sensitive information and you must protect it from unauthorized access. A compromised consumer secret can give unauthorized attackers access to everything related to your application, including listening into active conferences, downloading recordings, etc. Currently, you will have to create a new app if you believe the consumer secret has been compromised.

Enhanced Conference Access Control

The Enhanced Conference Access Control setting uses a conference access token to limit a conference participant's permissions. If an application does not have the setting enabled, participants can access the conference using the client access token, but the conference is unprotected from unwanted operations. Clients can manage the participants scope of operations by setting, updating, and revoking permissions. For more information, see the Enhanced Conference Access Control article.

Client side application

The client SDKs provide two mechanisms to authenticate against the service, the initialize and initializeToken methods. The initialize method is provided only for testing the platform and is not recommended to use in a production application. Dolby will deprecate this API in the near future.

In order to protect the consumer secret, the best practice is to build and maintain an authentication server, which has access to your consumer secret, and can act as a proxy to retrieve an access token from the Communications APIs platform and return the token to the client application. The client application can use the initializeToken method to authenticate with the platform. As a Communications APIs customer, it is your responsibility to protect this authentication server from unauthorized access.

The access token has a default validity period; it can be customized to a shorter duration to further improve the security of the access token. For more information, refer to the latest Authentication API.

Server side application

Currently there are server side APIs such as remix and streaming that still use Basic authentication. These APIs will evolve to token authentication similar to the Conference API and Monitor API. The server side token authentication, also supports expiration customization to shorten the validity period of the access token.

Media encryption

The Communications API platform employs standard real-time media (audio, video, and screen-share) encryption technology from WebRTC. It uses AES-128 to encrypt media, and HMAC-SHA1 to verify data integrity. The media is transported over Secure Real-Time Protocol (SRTP) and the encryption keys are exchanged using the Datagram Transport Layer Security (DTLS) protocol.

The Communications APIs platform will temporarily decrypt the media when received from a client, and then immediately re-encrypt before sending to other clients in the conference. This short decryption/re-encryption process is necessary for managing the conference media routing, and also for supporting features such as recording and streaming. Your media is never transported over the Internet unencrypted.

Currently, the Communications APIs platform does not support end-to-end encryption.

Signaling encryption

All signaling communications, including both internal and external REST API calls and WebSocket connections from the client to the Communications APIs platform, are encrypted using the Transport Layer Security (TLS) protocol.

Certain mobile device platforms, such as Android 4 or iOS6, use proven insecure transport protocols such as TLS 1.0 and TLS 1.1. Dolby plans to discontinue the support for these TLS protocol versions in the near future. This means that customers using devices running older platforms will no longer be able to connect to the Communications APIs platform.


If your application uses the Communications API platform's recording functionality, your conference recording is saved on AWS S3 encrypted at rest.

To retrieve your conference recordings, you can either rely on the webhook notification, or use the Monitor API. In the case of the Monitor API, a short lived-signed URL is provided for you to retrieve the recording. Dolby recommends that you download and remove the recording from the Communications APIs immediately after it is generated.

Webhook signature validation

In order to protect your application from malicious actions including replay attacks, the Communications API platform supports signature validation to validate the signature and expiration of an incoming event. Webhook signature validation is optional, but allows you to ensure that the event is sent from a trusted source.