Developers

Put video — and leak-traceable sessions — inside your own app.

The same SDKs our apps are built on: meetings and webinars in the browser, native real-time and secure playback on Android, iPhone, iPad and Mac. Your backend creates sessions in your tenant and mints single-use join grants; your app joins, plays, and — in secure mode — draws the mark. Roles are decided on the server, never on the device, and leaks trace to your app and the account.

How it fits Host SDK Client SDKs Webhooks Obligations Metering

1 · Register

Account, app builds, API key

Ask for a developer account from the console, register the bundle ids and signing certificates of the app builds that may join secure sessions, and issue an API key. Test keys are there for development.

2 · Your backend

Sessions and grants

Create and start sessions in your own tenant with the Host SDK, mint a join grant per user (it fixes session, identity and role), receive signed webhooks.

3 · Your app

Join, play, mark

The Client SDK attests the app, joins with the grant, plays secure HLS with the per-session key, and runs the render-pass mark on every frame; real-time sessions publish and subscribe over WebRTC.

Host SDK · your backend

Sessions, grants, webhooks — from Node.

@supermeet/host-sdk wraps the REST API with your API key: sessions.create/get/start/end, grants.mint, apps.register, verifyWebhook. No runtime dependencies; Node 18+.

Sessions live in your tenant; customers never see each other
Grants are single-use and expire in seconds; they never carry the key
Every REST call is documented in the OpenAPI file

import { SupermeetHost, verifyWebhook } from '@supermeet/host-sdk';

const host = new SupermeetHost({ apiBase: 'https://api.supermeet.io',
  apiKey: process.env.SUPERMEET_API_KEY!, developerId: 'dev_123' });

const s = await host.sessions.create({ product: 'webinar', title: 'Launch — spring collection' });
const start = await host.sessions.start(s.id, { host_platform: 'macos' });   // ingest + playback
const { grant } = await host.grants.mint({ session_id: s.id, identity: 'user-42', role: 'attendee' });
// hand `grant` to your app; the Client SDK joins with it

app.post('/hooks/supermeet', async (req, res) => {
  const ok = await verifyWebhook(req.header('X-Supermeet-Signature'), req.rawBody, WEBHOOK_SECRET);
  res.sendStatus(ok ? 204 : 400);   // session.started · session.ended · participant.joined
});

Client SDKs · the device

Attested join, secure playback, the mark, real-time.

Android · Kotlin

SupermeetClient, SecureWindow, WatermarkEffect

Play Integrity attestation, a secure window before the first frame, Media3 playback with the per-session key resolved by the SDK, the GPU mark as a Media3 effect, and RealTimeSession for meetings and promoted speakers.

iPhone · iPad · Mac · Swift

SupermeetClient, SupermeetSecure, SecureVideoView

App Attest, a capture guard that blacks out on detection, AVPlayer with the SDK's key loader, a Metal render pass that marks every frame, and RealTimeSession with camera, microphone and app-fed surface tracks. Secure sessions on a Mac need macOS 27 on Apple silicon.

Web · TypeScript

@supermeet/web-sdk

The control-plane client, the real-time data channel (chat, Q&A, polls, ink, slides) and the surfaces layout engine for meetings and webinars in the browser. Non-secure products only, by design.

Web · embed

<supermeet-session>

A Web Component and a React wrapper that put a Supermeet meeting, webinar or Standard live class inside your page, joined with your grant and limited to the origins you register.

The SDKs are handed to registered developers with their keys; they are not on public package registries.

Webhooks

Register an endpoint and Supermeet posts session.started, session.ended and participant.joined as JSON. Every delivery carries X-Supermeet-Signature: t=<unix>,v1=<hex HMAC-SHA256 over "t.body"> and is retried on network errors and server-side failures. Verify with the Host SDK; reject timestamps older than five minutes.

Integrator obligations

Keep the capture guard enabled and the SDK unmodified; the mark is drawn on the composed framebuffer before presentation.
Never put access tokens, keys or grants in URLs or logs. Grants are single-use and expire in seconds.
Your app id and signing certificate are part of the attestation; rotate keys through the developer endpoints.
Tell participants that secure sessions are marked to them — the SDK carries the disclosure in English and Hindi — and link the full notice.

Metering

SDK usage is metered by the minute — participant-minutes in real-time sessions, viewer-minutes on the broadcast path — against your developer account; no seat licences. Talk to us for pricing and for the integrator programme.

The full integration guide, the OpenAPI reference and sample apps are handed to registered developers with their test key; write to developers@supermeet.io.