Certificate pinning is available on native platforms via RoomOptions.networkOptions. It applies to SDK-owned WSS signaling and internal HTTPS requests, but not to WebRTC media, TURN, or application-owned token endpoints.
Key Rules:
- Web Support: Pinning is not supported on Flutter web. Configuring it on web will cause
Room.connect to throw an UnsupportedError. - Host Matching: Supports exact hosts, single-label wildcards (
*.livekit.cloud), and multi-label wildcards (**.livekit.cloud). Use **.livekit.cloud to ensure coverage for LiveKit Cloud regional failover hosts. - SPKI Pins: Use SPKI SHA-256 pins in
primaryPins and backupPins. The SDK matches these against the leaf certificate's public key only. Do not pin intermediate or root CA keys, as Dart does not expose the full chain. - Leaf Certificates: Use
pinnedLeafCertificates to require an exact peer leaf certificate. If using private PKI, you must also configure trustedCertificates to anchor the validation.
// Example: SPKI Pinning
final roomOptions = RoomOptions(
networkOptions: NetworkOptions(
certificatePinning: CertificatePinningOptions(
rules: [
CertificatePinningRule(
hosts: ['**.livekit.cloud'],
primaryPins: ['sha256/current-public-key-pin'],
backupPins: [
'sha256/next-public-key-pin-1',
'sha256/next-public-key-pin-2',
],
),
],
),
),
);
final room = Room(roomOptions: roomOptions);
await room.connect(url, token);
// Example: Exact Leaf Certificate and Custom Trust Store
final certificate = await CertificateBytes.fromAsset(
'assets/livekit_leaf_cert.pem',
);
final roomOptions = RoomOptions(
networkOptions: NetworkOptions(
certificatePinning: CertificatePinningOptions(
rules: [
CertificatePinningRule(
hosts: ['my-project.livekit.cloud'],
pinnedLeafCertificates: [certificate],
trustedCertificates: [certificate],
),
],
),
),
);