Package 

Class StreamEncryptionManager

  • All Implemented Interfaces:
    io.getstream.video.android.core.e2ee.E2EEManager 
    
public final class StreamEncryptionManager
 implements E2EEManager

    The SDK's default E2EEManager, backed by WebRTC's framed AES-GCM encryption. Frames are encrypted before they leave the device and decrypted after they arrive, so the SFU forwards media it cannot read.

    Typical use, matching the JavaScript and iOS SDKs:

    StreamEncryptionManager.create(myUserId).onSuccess { e2ee ->
    e2ee.setSharedKey(keyIndex = 0, key = myKeyBytes)
    call.setE2EEManager(e2ee)
    call.join()
}

    You own the instance you create: keep it for as long as you need to rotate keys, and call dispose when you are done with it. The SDK does not dispose managers it did not create, since the same manager is usually reused across rejoins and often across calls.

    Instances are safe to use from any thread. Key changes take effect on the frames encrypted after they are applied.

    • Method Detail

      • encrypt

         Result<Unit> encrypt(RtpSender sender, String codec, E2EETrackType trackType)

        Called once per outgoing track, right after the publisher adds its transceiver. The implementation is expected to install a frame encryptor on sender.

        Parameters:
        sender - The sender carrying the local track.
        codec - The negotiated codec, lowercased and without a MIME prefix (opus, vp8, av1), or null when the SDK cannot determine it.
        trackType - Which kind of track this is, or null when it cannot be mapped.

      • decrypt

         Result<Unit> decrypt(RtpReceiver receiver, String userId, E2EETrackType trackType)

        Called once per incoming track, when the subscriber learns which participant it belongs to. The implementation is expected to install a frame decryptor on receiver.

        Parameters:
        receiver - The receiver carrying the remote track.
        userId - The user the track belongs to.
        trackType - Which kind of track this is, or null when it cannot be mapped.

      • setSharedKey

         final Unit setSharedKey(Integer keyIndex, ByteArray key)

        Sets the key used for every participant that has no per-user key, including your own outgoing media. Use this when everyone in the call shares one passphrase-derived key.

        Safe to call during a call to rotate keys: write the new key to the next index, and peers that still hold the old index can decode frames that were already in flight.

        Parameters:
        keyIndex - Slot to write to.
        key - Raw key bytes, sized for algorithm — 16 bytes for AES-128-GCM, 32 for AES-256-GCM.

      • setKey

         final Unit setKey(String userId, Integer keyIndex, ByteArray key)

        Sets the key for a single participant, which takes precedence over the shared key. Use this when each participant publishes under their own key. See setSharedKey for rotation.

      • setEventListener

         final Unit setEventListener(E2EEEventListener listener)

        Observes encryption state changes, most importantly decryption failures. Pass null to stop observing. The listener is invoked on a WebRTC internal thread, so hop to your own dispatcher before touching UI state.

      • dispose

         final Unit dispose()

        Releases the native manager and wipes its keys. Drops the setEventListener observer first so a listener that captured a ViewModel or Activity is not kept alive by native. Subsequent key operations are ignored; attempting to attach an encryptor or decryptor returns a failure so the SDK cannot treat an unprotected track as configured. Dispose only once you are done with every call that uses it.