The Challenge
Typical real-time video platforms rely heavily on complex Node.js/Socket.io servers, making them difficult and expensive to host, maintain, and scale for businesses using standard cloud or cPanel web server environments. The client needed a secure, multi-tenant WebRTC meeting room app that could deploy natively on a standard PHP/MySQL stack, without sacrificing real-time video latency or enterprise security.
Additionally, the platform required dial-in voice support, enabling users without internet connections to call in via normal phone lines and join the WebRTC meeting room bridge dynamically.
The Solution
We architected the solution by separating heavy video/audio streaming from the signaling database logic. The front-end leverages WebRTC client-to-client connections brokered via CDN-loaded Twilio Video SDKs, authenticated with short-lived JWT tokens generated by our PHP backend.
For the dial-in capability, we integrated the Twilio Voice API, setting up custom TwiML webhooks that parse incoming conference dial-ins, verify user passcodes against our MySQL database, and place them directly into the same WebRTC conference bridge with real-time audio mapping.
Technical Architecture & Highlights
All Twilio Auth tokens, API keys, and sensitive host database settings are encrypted using AES-256-CBC cipher prior to database storage, managing keys securely outside the public web root.
Hosts can toggle a visual gate. Guests wait in an AJAX-polling state in-browser, while hosts receive real-time admin toast notifications to admit or deny entry.
To protect hosts and SaaS tenants from brute force attacks, a DB-backed rate-limiter temporarily blocks IP addresses for 15 minutes after 5 failed password attempts.
Meeting invitations employ custom 16-character cryptographically secure hex-slugs, rendering meeting URLs virtually immune to enumeration attacks.