Rooms, and the two ways into one.

In the console, or over the API with a token that has write scope. A room is created with a name and a size; everything else has a default you can change later.

curl -X POST https://dash.yunzheng.space/api/v1/rtc/rooms \
  -H "Authorization: Bearer $ORBIT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Weekly sync","max_peers":12,"max_video":4}'

The reply carries the room’s key and, when link access is on, the address to hand out. Both are in the console too — the API is the same room seen from a script.

With link access on, a room is reachable at its own address and needs nothing installed. The page asks the browser for a microphone, and for a camera when the room takes video.

https://rtc.yunzheng.space/r/<room key>

Send it the way you would send any other address. Anybody holding it can open the room, which is the reason a room that matters should also carry a passcode, a human check, or both.

One script tag, then one call. The library has no dependencies and no build step, and it draws nothing on its own: you get the media streams and place them in your own layout.

<script src="https://rtc.yunzheng.space/v1.js"></script>
<script>
  OrbitRTC.room("<room key>").then(function (room) {
    // room.needs_passcode / room.needs_verify say what to ask for first.
    return OrbitRTC.join({
      room: "<room key>",
      label: "Ada",
      passcode: room.needs_passcode ? prompt("Passcode") : "",
      video: false,
      onTrack: function (stream) {
        var el = document.createElement("audio");
        el.srcObject = stream;
        el.autoplay = true;
        document.body.appendChild(el);
      },
      onError: function (err) { console.error(err.code, err.message); }
    });
  }).then(function (session) {
    window.addEventListener("pagehide", function () { session.leave(); });
  });
</script>

Ask the room what it needs before you render a form, rather than finding out by being refused: OrbitRTC.room() answers with whether a passcode and a human check are required, so the page can put up the right prompt once.

A room checks its conditions before a participant is admitted, so a refusal costs nothing and reveals nothing about who is inside.

• A passcode — set on the room, never returned by the API once set. Change it and the old one stops working at once.
• A human check — at standard, strict or maximum. The level is part of what is checked: a token earned at standard does not satisfy a room set to maximum.
• No link at all — with link access off, the room address admits nobody, and only the service you built decides who goes in.

A room runs in one city, and the console names it. The city is fixed on the first join and does not change while people are in the room, because moving a room means dropping everyone in it.

Nothing in a room is recorded. There is no recording to switch on, and no stored copy of what was said or shown.