Hi everyone, How do you manage key exchange between multiple users for end-to-end encryption ?

For multi-user E2EE with a LiveKit agent, the typical approach is to use client-side generated room keys and distribute them via a secure signaling channel (e.g., your backend with authenticated users). Each participant fetches the shared room key after auth, then uses it for SRTP frame encryption/decryption, while the agent either joins with the same key or operates in a trusted server context if processing is required. I’ve implemented similar E2EE flows (key generation, rotation, and secure distribution) and can help you set up a robust scheme with proper key lifecycle and access control. @helpful-crowd-34956

Thanks for the reply ! It is very comprehensive but I have a question: if the backend knows the key, is it still considered end-to-end encryption ?

if the backend has access to the room key, it’s no longer pure end-to-end encryption, since the server could theoretically decrypt the media. That model is usually called trusted server E2EE. For true E2EE, the key should be generated and exchanged only on the clients (e.g., via client-side key agreement or encrypted key exchange), so the backend never sees the raw key. The server then only handles signaling and encrypted frame forwarding, without decryption capability. In practice, the choice depends on whether the LiveKit agent needs to process the media. If it must analyze audio/video, it will need access to the key (trusted context). If not, we can design a fully client-held key scheme to preserve strict E2EE guarantees. @helpful-crowd-34956

yes ! it's just for the video calling feature

Since it’s just for video calling, we can go fully client-side for E2EE: each participant generates or receives the room key directly on their device, and the server only handles signaling without ever seeing the key. This way, all media stays encrypted end-to-end, and the server or agent cannot decrypt the video—true E2EE for your calls. I can help set this up so that key generation, distribution, and rotation happen securely, keeping your video calls fully private. @helpful-crowd-34956

thanks for all ! What is the typical workflow for key exchange?

Typically, one client generates a random room key locally and then securely shares it with the other participants—each key is encrypted for the recipient so the backend never sees the raw key. Once each participant decrypts it on their device, they use it to encrypt outgoing media and decrypt incoming media. Periodically, the key can be rotated, following the same secure exchange, to maintain strong E2EE for the video calls. @helpful-crowd-34956