# HMAC-Signed token authentication

**URL:** <https://janus.discourse.group/t/hmac-signed-token-authentication/1246>\
**Category:** General\
**Created:** [August 23, 2024, 4:41pm UTC](https://janus.discourse.group/t/hmac-signed-token-authentication/1246 "2024-08-23T16:41:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nikolay](https://avatars.discourse-cdn.com/v4/letter/n/a698b9/32.png) [@Nikolay](https://janus.discourse.group/u/Nikolay)\
**Post date:** [August 23, 2024, 4:41pm UTC](https://janus.discourse.group/t/hmac-signed-token-authentication/1246/1 "2024-08-23T16:41:25Z")

</div>

I have configured Janus, and it works great with the “Stored token based authentication mechanism”. However, when trying to implement “HMAC-Signed token authentication” for the videoRoom plugin, I am unable to authenticate. I generate a code like: “1724437402,janus,janus.plugin.echotest,janus.plugin.videocall,janus.plugin.videoroom:6vGyTy5xuf/85+zWCgyVIybwE7g=”, I added `token_auth` and `token_auth_secret` to the config, then I try to connect on the web client side using `janus.js`:

```auto
// Create session
janus = new Janus({
    server: server,
    iceServers: iceServers,
    token: "1724437402,janus,janus.plugin.echotest,janus.plugin.videocall,janus.plugin.videoroom:6vGyTy5xuf/85+zWCgyVIybwE7g=",
    success: function() {
        // Attach to VideoRoom plugin
        janus.attach({
            plugin: "janus.plugin.videoroom",

```

And I get the error: Unauthorized request (wrong or missing secret/token). What am I doing wrong?

---

<div class="post-metadata">

**Author:** ![lorenzo](https://yyz2.discourse-cdn.com/free1/user_avatar/janus.discourse.group/lorenzo/32/425_2.png) [@lorenzo](https://janus.discourse.group/u/lorenzo)\
**Post date:** [August 26, 2024, 8:34am UTC](https://janus.discourse.group/t/hmac-signed-token-authentication/1246/2 "2024-08-26T08:34:35Z")

</div>

Please refer to the documentation for more info:  
[https://janus.conf.meetecho.com/docs/auth](https://janus.conf.meetecho.com/docs/auth)

---

<div class="post-metadata">

**Author:** ![Nikolay](https://avatars.discourse-cdn.com/v4/letter/n/a698b9/32.png) [@Nikolay](https://janus.discourse.group/u/Nikolay)\
**Post date:** [August 26, 2024, 9:21am UTC](https://janus.discourse.group/t/hmac-signed-token-authentication/1246/3 "2024-08-26T09:21:06Z")

</div>

I read it twice, in case of “Stored token based authentication” everything works fine as expected, but with HMAC-Signed token I don’t understand yet what I’m doing wrong. Maybe I’m transmitting the token from the web incorrectly? I’d be very grateful if you could point out my mistake more precisely.

---

<div class="post-metadata">

**Author:** ![homevk](https://avatars.discourse-cdn.com/v4/letter/h/9f8e36/32.png) [@homevk](https://janus.discourse.group/u/homevk)\
**Post date:** [September 20, 2024, 11:47am UTC](https://janus.discourse.group/t/hmac-signed-token-authentication/1246/4 "2024-09-20T11:47:57Z")

</div>

The documentation says

> HMAC-Signed tokens are ONLY available for the VideoRoom plugin

.Why @Nikolay is using signed tokens for

> janus.plugin.echotest,janus.plugin.videocall