> ## Documentation Index
> Fetch the complete documentation index at: https://docs-classic.cognigy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Learn how the Cognigy Click To Call SDK handles WebRTC security, TLS encryption, SIP credentials, and HTTPS requirements for secure browser-based calls.

This page covers security aspects of the Cognigy Click To Call SDK, including transport encryption, credential handling, and best practices.

## Transport Security

### HTTPS Requirement

The SDK requires a [secure context](https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts) (HTTPS or `localhost`) to function. WebRTC APIs such as `RTCPeerConnection` and `getUserMedia` are not available in insecure contexts.

### WebSocket Security

The SDK retrieves the WebSocket URI of the SIP server from the endpoint configuration. Use a WSS (WebSocket Secure) URI. It encrypts all SIP signaling traffic with TLS. The SDK doesn't check the scheme, so make sure that the configuration uses the `wss://` scheme.

### Media Encryption

WebRTC media streams (audio) are encrypted using DTLS-SRTP (Datagram Transport Layer Security — Secure Real-time Transport Protocol). DTLS handles the key exchange, and SRTP encrypts the audio data. The browser's WebRTC implementation enforces this, so no additional configuration is required.

### Configuration Fetch

During [`connect()`](https://docs-classic.cognigy.com/click-to-call/sdk/api-reference/connect), the SDK sends an HTTPS request to the `endpointUrl`. The response contains SIP credentials, the SIP server address, and session parameters. Because the response contains authentication credentials, use an HTTPS `endpointUrl`. The SDK doesn't enforce HTTPS. It sends the request to the URL exactly as you provide it.

## Credential Handling

### SIP Credentials

The SDK fetches SIP credentials from the Cognigy backend through the `endpointUrl` during [`connect()`](https://docs-classic.cognigy.com/click-to-call/sdk/api-reference/connect). The credentials are:

* Provided by the Cognigy backend.
* Managed internally by the SDK. Your application code doesn't handle them.
* Used only for SIP registration and call signaling.

### User Identification

The optional `userId` parameter is used for session identification only. The SDK uses it as part of the SIP identity (SIP URI). If you don't provide a `userId`, the SDK generates one.

> [!WARNING]
>
> Don't pass sensitive information such as passwords, tokens, or personally identifiable information (PII) as the `userId`.

## Network Security

### Firewall Configuration

The SDK requires the following network access:

| Protocol | Direction | Purpose |
| - | - | - |
| HTTPS | Outbound | Fetch endpoint configuration |
| WSS | Outbound | SIP signaling via WebSocket |
| UDP/TCP | Outbound | RTP media streams (audio) |

## Best Practices

* Serve your application over HTTPS in production. WebRTC APIs require a secure context.
* Don't log SIP credentials. The SDK handles credentials internally. Avoid intercepting or logging them.
* Don't pass PII as `userId`. Use an opaque session identifier instead.

## More Information

* [Initialization and Authentication](https://docs-classic.cognigy.com/click-to-call/sdk/initialization.md)
* [Supported Browsers](https://docs-classic.cognigy.com/click-to-call/sdk/supported-browsers.md)
* [Troubleshooting](https://docs-classic.cognigy.com/click-to-call/sdk/troubleshooting.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.