WHIP / WHEP: WebRTC publish and play

WHIP (publish) and WHEP (play) are the standard HTTP-signaled WebRTC ingest and egress protocols. They are the lowest-latency way in and out of TRaX and work natively from a browser.

Endpoints

POST https://<trax-media-host>:8889/<path>/whip     # publish
POST https://<trax-media-host>:8889/<path>/whep     # play

Standard WHIP/WHEP semantics: POST an SDP offer (Content-Type: application/sdp), receive an SDP answer, ICE via the returned resource. TRaX also returns TURN servers in the signaling response where relay is required.

Authentication

Send the session token as a Bearer header:

Authorization: Bearer <jwt>

Two token audiences exist for the WebRTC plane:

Token	Purpose
talk token (aud: trax-mediamtx-talk)	Publish-capable, scoped to your provisioned session; carries a can_publish claim
read token (aud: trax-mediamtx-read)	Single-path, short-TTL playback

Where a Bearer header is impossible (some players), the token is also accepted as an access_token query parameter on the WHIP/WHEP URL. Prefer the header — query strings end up in logs.

Hard rules

1. One token per path. The token's path claim must match the URL path.
2. Short TTLs. Read tokens especially are minted per playback session — don't cache them.
3. Audio codec: WebRTC audio is Opus. Feeds contributed over SRT/RTMP with AAC audio are transparently transcoded for WHEP playback; expect Opus on the receiving side.

Failure modes

Symptom	Likely cause
401 on the POST	Missing/expired token, wrong audience for the operation
404	Path not provisioned (or a typo — paths are exact-match)
Connects, video but no audio in browser	Player expecting AAC — WebRTC delivers Opus