RonanCodes/jitsi-jaas

Jitsi as a Service (JaaS)

Branded, authenticated video in your own app. JaaS (by 8x8, console at jaas.8x8.vc) is the production Jitsi: JWT-gated rooms, your branding, webhooks, and transcription. Use it over the free meet.jit.si whenever you need auth, transcription, or reliability — meet.jit.si is fine ONLY for a zero-setup demo where you just need a call on screen.

Pricing (JaaS, 2026)

Priced per Monthly Active User (MAU = a unique endpoint that attended a meeting with ≥1 other person that month), plus usage add-ons.

| Plan | MAU included | Price | |---|---|---| | Dev | 25 | Free (the demo plan) | | Basic | 300 | $99/mo | | Standard | 1500 | $499/mo | | Business | 3000 | $999/mo | | Enterprise | custom | Contact sales |

Overage: $0.99 / MAU beyond the included count. Add-ons (same on all plans): real-time transcription $0.03/min, recordings $0.01/min, RTMP streaming $0.01/min, SIP in/out $0.06/min, PSTN inbound 2 MAU, PSTN outbound 1 MAU + $0.03/min. Taxes/fees on top.

For Makely: on the free Dev plan (25 MAU) but with a card on file, so it's no longer free-only: the 25 MAU are still free, but usage add-ons and overage now bill for real. The two that bite: real-time transcription $0.03/min (the copilot feature) and $0.99 per MAU over 25. A handful of demo viewings is cents; just don't leave transcription running on a busy account unmonitored. Prices from the console (2026-06-27); confirm at jaas.8x8.vc → My plan.

What you get from the JaaS console

• App ID — looks like vpaas-magic-cookie-<hex>. Public-ish (goes in the room name + as JWT sub).
• API key (kid) — vpaas-magic-cookie-<hex>/<shortid>. Goes in the JWT header kid.
• Private key (.pk, PKCS#8 PEM -----BEGIN PRIVATE KEY-----) + its public key (.pub, uploaded to JaaS). You sign JWTs with the private key. Secret.

Env convention

Base64 the PEM so it survives a single-line env var:

JAAS_APP_ID=vpaas-magic-cookie-...
JAAS_KID=vpaas-magic-cookie-.../<shortid>
JAAS_PRIVATE_KEY_B64=<base64 of the .pk PEM>
NEXT_PUBLIC_JAAS_APP_ID=vpaas-magic-cookie-...   # the embed needs the App ID client-side

B64=$(base64 -i key.pk | tr -d '\n'). Verify the key first: openssl rsa -in key.pk -noout -check.

1. Mint the JWT (server-side, RS256)

Use jose. Header carries kid; claims aud:"jitsi", iss:"chat", sub:<appId>, room:"*" (or a specific room), and a context with the user + feature flags. Transcription is a feature flag.

import { SignJWT, importPKCS8 } from "jose";
export async function mintJaasToken({ name, email, moderator }: {...}) {
  const pem = Buffer.from(process.env.JAAS_PRIVATE_KEY_B64!, "base64").toString("utf8");
  const key = await importPKCS8(pem, "RS256");
  const now = Math.floor(Date.now()/1000);
  return new SignJWT({
    aud:"jitsi", iss:"chat", sub:process.env.JAAS_APP_ID!, room:"*",
    context:{ user:{ name, email, moderator: moderator?"true":"false" },
              features:{ transcription:"true", recording:"false" } },
  }).setProtectedHeader({ alg:"RS256", kid:process.env.JAAS_KID!, typ:"JWT" })
    .setIssuedAt(now).setExpirationTime(now+3*3600).setNotBefore(now-10).sign(key);
}

Common 401 causes: wrong kid (must be the full appId/shortid), sub not the App ID, public key not uploaded to JaaS, or signing with the wrong key. moderator/features must be strings ("true"), not booleans.

2. Embed via JitsiMeetExternalAPI

Domain is 8x8.vc; room name is <appId>/<room>; load the app-scoped script. Client component:

const s = document.createElement("script");
s.src = `https://8x8.vc/${appId}/external_api.js`;   // app-scoped, not the generic one
s.onload = () => {
  const api = new window.JitsiMeetExternalAPI("8x8.vc", {
    roomName: `${appId}/${room}`, jwt, parentNode: el,
    configOverwrite: { prejoinPageEnabled: false },
  });
  api.addListener("transcriptionChunkReceived", d => onTranscript(d.messageText ?? d.final ?? ""));
};

Always api.dispose() on unmount. A strict CSP must allow https://8x8.vc for script + frame.

3. Live transcription → app (the copilot use case)

With transcription:"true" in the JWT, the External API emits transcriptionChunkReceived as people speak. Pipe that text into your app (e.g. an LLM that ticks off covered questions / surfaces the next one). This is the reason to use JaaS over the free instance: the transcript is actually available to your code. (Recording + transcription storage are also deliverable via webhooks.)

4. Webhooks (optional)

Console → Webhooks → Add endpoint (https://<app>/api/jaas/webhook). Events include room created/destroyed, participant joined/left, recording uploaded, transcription ready. Verify the signature per the JaaS docs, then update your DB (e.g. mark a viewing attended, store a transcript URL). Set them up only when you need server-side reactions; the in-call External API events cover the live copilot without webhooks.

Checklist

• [ ] Private key base64 in env (never committed); public key uploaded to JaaS; openssl ... -check passes.
• [ ] JWT: RS256, kid = full appId/shortid, sub = appId, string feature flags.
• [ ] Embed on 8x8.vc, room <appId>/<room>, app-scoped external_api.js, dispose() on unmount.
• [ ] Transcription flag on + transcriptionChunkReceived wired if you need the transcript.
• [ ] Fall back to meet.jit.si only as a keyless demo path.
• [ ] Webhooks only if you need server-side room/recording/transcription reactions.

Further reading

• JaaS docs: https://developer.8x8.com/jaas/docs
• JWT spec: https://developer.8x8.com/jaas/docs/api-keys-jwt
• iframe / External API: https://developer.8x8.com/jaas/docs/api-keys-and-jwt (and the lib-jitsi-meet External API reference)