To enable authentication, configure the identity method for your deployment, then decide separately whether unauthenticated guests may join. Debian/Ubuntu package installations and Docker Compose deployments expose different settings. For a new installation, use Jitsi’s token/JWT guidance rather than the older secure-domain recipe: the Jitsi Handbook states, “This method of authentication is deprecated and should not be used in new installations. It is recommended to use JWT authentication instead, as described in Authentication.”
The instructions below reflect the official Jitsi Handbook guidance reviewed on 13 October 2026. Hostnames, realms, issuers, audiences, key URLs and secrets are examples; replace them with values for your server and verify the current guide against the Jitsi and Prosody versions you have installed.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Understand what authentication controls
Jitsi has two separate access decisions that are often confused:
- Who may create a room: authentication can require the person who creates or claims a conference to prove an identity.
- Who may join a room: guest settings determine whether participants without credentials can enter after an authenticated moderator has opened the room.
Those controls can be combined. A common policy is “authenticated room creators, anonymous guests.” In that arrangement, a signed-in user creates the meeting, while invitees join without accounts. If you disable guest access, every participant must authenticate. Enabling authentication does not automatically mean that every attendee needs an account.
#1 Best Overall
- Compatible with Nintendo Switch 2’s new GameChat mode
- Crisp HD 720p/30 fps video calls with diagonal 55° field of view and auto light correction. Compatible with popular platforms including Skype and Zoom.
- The built-in noise-reducing mic makes sure your voice comes across clearly up to 1.5 meters away, even if you’re in busy surroundings.
- C270’s RightLight 2 feature adjusts to lighting conditions, producing brighter, contrasted images to help you look good in all your conference calls.
- The adjustable universal clip lets you attach the camera securely to your screen or laptop, or fold the clip and set the webcam on a shelf. You’re always ready for your next video call.
| Room-creation policy | Guest setting | Result |
|---|---|---|
| Authentication required | Guests enabled | An authenticated user creates or starts the room; unauthenticated participants can join when the authenticated participant is present. |
| Authentication required | Guests disabled | Every participant must authenticate. |
| No authentication gate | Guests enabled | Anyone who can reach the service may create or join rooms, subject to your other moderation controls. |
Choose the policy before editing files. Otherwise, an apparently successful authentication change may still leave room creation open to everyone or unexpectedly block invited guests.
Prepare the server before changing settings
- Use a public DNS name and valid HTTPS certificate. Jitsi’s self-hosting overview identifies an internet server with a certificate for a DNS domain as the best-supported arrangement. Private-network and self-signed-certificate deployments can be harder to use across private and public networks, and some phones reject self-signed certificates.
- Record your exact public hostname. In examples below,
meet.example.orgmeans the hostname visitors open in a browser. Do not substitute the internal guest XMPP hostname for this public name. - Back up configuration. Save your Prosody virtual-host files, Jitsi web configuration, Docker
.envfile and any account database before editing them. - Protect secrets. JWT signing secrets, token application secrets, LDAP passwords and identity-provider credentials belong in restricted files or a secret-management system, never in a public tutorial, issue tracker or client-side JavaScript.
- Check versions and documentation. Jitsi’s pages do not expose a single release number for these instructions. Configuration names can change with Jitsi, Prosody or the container image, so compare the current Handbook page with your installed version.
Choose an authentication method
Jitsi documents several identity sources. The right choice depends more on where accounts already live than on a universal performance or security ranking; the official pages provide no quantitative comparison.
| Deployment | Identity source | Guest behavior | Administration | Documentation status |
|---|---|---|---|---|
| Debian/Ubuntu packages | JWT/token authentication; older internal accounts are also documented | Optional anonymous guest virtual host | Install and maintain Prosody settings, token issuer and service restarts | Token authentication is current; secure-domain/internal recipe is deprecated for new installs |
| Docker Compose | Internal accounts, JWT, LDAP, Matrix or hybrid Matrix-token modes | ENABLE_GUESTS controls whether unauthenticated participants may join |
Set environment variables and manage accounts or external identity services | Documented in the current self-hosting guide |
| Existing Debian secure-domain setup | Prosody internal accounts | Guest virtual host can remain anonymous | Manual Prosody, Jicofo and web configuration | Legacy method; use only when maintaining an existing deployment |
Debian or Ubuntu package installation: current token approach
For a package-based server, Jitsi’s Token Authentication guide uses a token module rather than the deprecated secure-domain recipe. The token issuer—your application or identity provider—must create tokens containing the claims your server accepts. Keep application ID and secret values private.
1. Install the token package
On the Jitsi host, install the package named jitsi-meet-tokens using your normal Debian or Ubuntu package workflow. The package must match the Jitsi/Prosody setup on that server. If your installation came from another source, do not mix package instructions into it without checking the matching documentation.
2. Configure the authenticated Prosody host
Edit the Prosody virtual-host configuration for your public Jitsi hostname, normally under the Prosody configuration directory created by the package installation. Set the authentication mechanism and the application identifier and secret required by the token guide. Conceptually, the authenticated host remains your public service name:
VirtualHost "meet.example.org"
authentication = "token"
app_id = "REPLACE_WITH_YOUR_APPLICATION_ID"
app_secret = "REPLACE_WITH_A_LONG_RANDOM_SECRET"Use the exact option names and module stanza shown for the version of jitsi-meet-tokens you installed. Do not copy the example secret, and do not publish the resulting file.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- Compatible with Nintendo Switch 2’s new GameChat mode
- Auto-Light Balance: RightLight boosts brightness by up to 50%, reducing shadows so you look your best—compared to previous-generation Logitech webcams (1)
- Privacy with a Slide: The integrated webcam cover makes it easy to get total, reliable privacy when you're not on a video call
- Built-In Mic: The built-in microphone lets others hear you clearly during video calls
- Easy Plug-And-Play: The Brio 101 works with most video calling platforms, including Microsoft Teams, Zoom and Google Meet—no hassle; it just works
3. Add a guest virtual host only if guests should be allowed
When your policy is authenticated room creators with anonymous attendees, add the internal guest virtual host described by the token guide. It is conventionally named guest.meet.example.org and uses the anonymous guest authentication module. This host is an internal XMPP endpoint: Jitsi says it does not need a DNS record, a certificate or web-server configuration. It is not a second public website.
4. Point the web client at the guest domain
In the Jitsi web configuration file for your hostname, set anonymousdomain to the guest XMPP domain, for example:
anonymousdomain: 'guest.meet.example.org',Set this only when the guest virtual host exists. A typo or mismatch between the Prosody host and anonymousdomain commonly causes guests to receive an authentication error even though the creator can sign in.
5. Restart the XMPP and conference services
After validating the syntax, restart Prosody, Jicofo and the videobridge service used by your installation (the package guide refers to jitsi-videobridge2). Restart all three so that the web client, XMPP authentication and conference focus use the same configuration. Watch service logs during the restart; a single malformed Prosody option can prevent the XMPP service from loading.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall6. Test both sides of the policy
- Open a private browser window and request a token from your issuer for the real public hostname, issuer and audience values.
- Use that token to create a uniquely named room. Confirm that a user without a token cannot create or claim a new room.
- With the authenticated user still present, open the room in a second window without credentials. If guests are enabled, the second window should join anonymously.
- Repeat with the authenticated user gone or with guest access disabled. The result should match the participant policy you selected, not an accidental fallback to open room creation.
External identity provider and JWT configuration
Jitsi’s current Authentication guide describes token-based authentication backed by an external identity provider. This is the appropriate direction for a new installation when identities are managed outside Prosody. The guide’s example configures the Prosody virtual host for token authentication and defines:
- the accepted token issuer;
- the accepted audience;
- a key-cache URL used to obtain or cache verification keys; and
- a guest virtual host for anonymous participants, when guest access is part of the policy.
In the web configuration, set anonymousdomain to that guest host. Replace every sample hostname, realm, issuer, audience and URL with values from your identity provider. A token signed by the wrong issuer or intended for a different audience should be rejected; accepting a broad issuer or audience defeats the purpose of the control.
Rank #3
- 1080P Webcam with Cover for Video Calls - EMEET computer webcam provides design and Optimization for professional video streaming. Realistic 1920 x 1080p video, 5-layer anti-glare lens, providing smooth video. C960 computer camera delivers 1920x1080 video with fixed focus (11.8–118.1 inches), so as to provide a clearer image. C960 USB webcam has a cover and can be removed automatically to meet your needs for privacy. For optimal image performance, use the webcam in a well-lit environment.
- Built-in 2 Omnidirectional Mics - EMEET webcam with microphone for desktop features 2 built-in omnidirectional microphones, picking up your voice to create clear audio for communication. When installing the webcam, select EMEET C960 as the default microphone input device in your computer and video applications and select C960 as the default device in Zoom/Teams and ensure microphone permissions are enabled for proper use. Please note that C960 does not include built-in speakers.
- Automatic Light Adjustment - Automatic exposure adjustment is applied in EMEET HD webcam 1080p so that the streaming webcam can deliver stable image performance. EMEET C960 camera for computer also features color adjustment and exposure optimization to help you look your best. For optimal video quality, it is recommended to use the webcam in normal or well-lit environments and select suitable video settings in your application. Proper lighting helps achieve a clearer and more balanced image.
- Plug-and-Play & Upgraded USB Connectivity - New C960 webcam features both USB Type-A & A-to-C adapter connections for wider compatibility. For stable performance, connect the webcam directly to the computer's main USB port and ensure the device is recognized correctly. If a hub or docking station is used, please ensure it provides sufficient power and stable data transmission, as limited ports may affect performance. 90° wide-angle lens captures more participants without frequent adjustments.
- High Compatibility & Multi Application - C960 webcam for laptop is compatible with Windows 10/11, macOS 10.14+, and Android TV 7.0+. Not supported: Windows Hello, TVs, tablets, or game consoles. It works with Zoom, Teams, Facetime, Google Meet, YouTube and more. Please select C960 webcam as the default camera and microphone device in your application and ensure camera/microphone permissions are enabled, especially on macOS. (Tips: Incompatible with Windows Hello)
The same guide documents waiting for a host and persistent-lobby behavior. These are meeting-flow controls, not substitutes for identity checks: waiting-room or lobby settings can hold participants until a moderator admits them, while token authentication determines who is authorized to create or enter under your policy.
Docker Compose: configure authentication in .env
Docker deployments do not use the package file-edit sequence above. The self-hosting guide puts the main switches in the Compose project’s .env file. Set the values before recreating the stack:
| Variable | Purpose | Typical decision |
|---|---|---|
ENABLE_AUTH |
Turns authentication controls on | Set to 1 or the enabled value accepted by your compose version. |
ENABLE_GUESTS |
Allows unauthenticated participants after an authenticated participant arrives | Enable for “authenticated creator, guest attendees”; disable when every participant must sign in. |
AUTH_TYPE |
Selects the identity backend | Use the backend documented for your deployment: internal, JWT, LDAP, Matrix or a supported hybrid mode. |
ENABLE_AUTO_LOGIN |
Controls automatic login behavior in the web client | Set according to whether browsers should be offered an automatic authenticated session. |
JICOFO_AUTH_LIFETIME |
Controls the lifetime of Jicofo’s authentication session | Choose a duration appropriate to your moderation workflow and security policy. |
The exact enabled values and additional variables depend on the container release. Preserve the variable names supplied by the current self-hosting guide and do not paste sample JWT or LDAP secrets into a shared repository.
Internal Docker accounts
For the internal backend, create and remove users from the Prosody container with prosodyctl. A documented container pattern is:
docker compose exec prosody prosodyctl --config /config/prosody.cfg.lua register alice meet.example.org 'USE-A-UNIQUE-PASSWORD'The configuration path can differ with the Compose project; use the path shown by your current container configuration. To remove an account, run the corresponding prosodyctl unregister command inside the Prosody container. Rotate or delete accounts when administrators leave, and never place real passwords in shell history shared with other operators.
JWT, LDAP and Matrix modes
For JWT, provide the issuer, audience, signing-key or key-cache settings required by your token service. For LDAP, provide the directory URI, bind details and search settings, then test directory reachability from the container network. Matrix and hybrid Matrix-token modes require the Matrix settings documented for that image. None of these modes is configured by merely setting AUTH_TYPE; the corresponding backend credentials and endpoints must also be valid.
Rank #4
- 【1080P Full HD with Wide-Angle Lens】 Step up your video quality with the Shcngqio TWC29 1080p webcam. A wide-angle lens paired with a 1/2.9" CMOS sensor renders sharp, vibrant images and smooth 30fps footage—well suited for gaming, video calls, remote learning, live streaming, and everyday content creation. Fine details and natural colors come through clearly in every frame.
- 【Built-In Noise-Canceling Microphone】 The TWC29 integrates an advanced noise-reducing microphone that picks up your voice while cutting down background ambient sound. Whether you're joining a webinar, hosting a conference, or streaming online, your speech stays crisp and understandable even in moderately noisy rooms.
- 【Automatic Light Correction for Any Setting】 This webcam dynamically adjusts exposure and color temperature to match your surroundings. From low-light bedrooms to sunlit home offices, the auto light correction helps balance brightness and detail so you consistently present a clear, well-lit image during calls and recordings.
- 【Slide-On Privacy Cover Included】 A dedicated privacy shield ships with every TWC29. Simply slide the cover over the lens when the camera is not in use to block the view and add a layer of everyday security. The slim, fitted design stays in place and does not interfere with image quality when open.
- 【Plug-and-Play USB Setup, Works Across Devices】 No drivers, no complicated configuration. Connect the TWC29 via its 5ft USB cable to a USB 2.0, 3.0, or 3.1 port—and use OTG with supported mobile devices—and you're ready to go. The adjustable universal clip attaches firmly to laptops and desktop monitors, giving you a stable mounting point out of the box.
Apply and verify the Compose change
- Edit
.envand review the resulting values, especiallyENABLE_GUESTS. - Recreate or restart the stack using the Compose procedure for your project so Prosody, Jicofo, the web service and the videobridge receive the new environment.
- Inspect container logs for authentication, token-validation or directory-connection errors.
- Test an authenticated room creator, an anonymous guest if enabled, and an unauthenticated room-creation attempt.
Maintaining an older Debian secure-domain deployment
Some existing Debian installations still use the secure-domain method. Jitsi’s page for that method explicitly marks it deprecated for new installations, so do not choose it for a fresh server. If you are repairing an established deployment, the documented sequence is:
- Change the primary Prosody virtual host to
authentication = "internal_hashed". - Add a
guest.<your-public-hostname>virtual host usingjitsi-anonymous. - Set
anonymousdomainin the Jitsi web configuration to that guest host. - Enable the XMPP authentication setting in Jicofo, but only for this legacy internal-account arrangement.
- Restart Prosody, Jicofo and
jitsi-videobridge2. - Create administrator accounts with
prosodyctl register username your-public-hostname password.
Do not carry the Jicofo authentication step into token authentication. Jitsi’s token guide warns that advice to enable authentication in jicofo.conf comes from older documentation and is outdated for token setups.
Troubleshoot the most common failures
Creators are still not challenged
Confirm that the authenticated virtual host is the one used by your public hostname, that the web client was rebuilt or restarted after editing its configuration, and that you are not testing an old browser session. In Docker, verify ENABLE_AUTH and AUTH_TYPE inside the running container rather than only in an unused copy of .env.
Recommended Free Tools
Guests receive an authentication error
Check that guest access is enabled, the guest virtual host exists, and anonymousdomain exactly matches it. The guest host normally needs no DNS record; adding public DNS will not fix a spelling mismatch in Prosody or the web configuration.
JWTs are rejected
Compare the token’s issuer, audience, expiry and signing key with the values configured in Prosody or the container. Check server time as well: a clock that is significantly wrong can make otherwise valid expiry claims fail. Keep the key-cache URL reachable from the Prosody container or host.
Every participant is forced to sign in
This is expected when guests are disabled. In Docker, inspect ENABLE_GUESTS; in a package installation, verify that the guest virtual host and anonymousdomain were intentionally configured. Do not weaken authentication globally just to admit guests; enable the guest path explicitly.
Phones or public users cannot connect
Recheck the public DNS record, certificate chain and HTTPS endpoint. Jitsi notes that self-signed certificates and mixed private/public routing can be especially problematic for phones. Resolve the network and certificate issue before changing authentication settings.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Operate the authenticated service safely
- Use long, unique secrets and rotate them through a planned maintenance window.
- Limit Prosody and container administration to trusted operators; account creation is equivalent to granting room-creation rights.
- Review logs after configuration changes for failed token validation, unknown users and repeated login attempts.
- Document whether your organization permits anonymous guests, and revisit that decision when meeting sensitivity changes.
- Keep a tested rollback copy of the last working configuration, but do not restore deprecated settings blindly after a Jitsi or Prosody upgrade.
- When using an external identity provider, restrict accepted issuer and audience values to your tenant and service rather than accepting arbitrary tokens.
The practical sequence is therefore: select the identity backend, set the creator policy, explicitly choose guest admission, apply the configuration surface for Debian or Docker, restart the services that consume it, and test both authenticated and anonymous paths.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
