LiveKit Test Client v6 (Firefox IP-literal TURN fix)

— page host info —

Why the selected pair sometimes shows prflx instead of relay
When media is relayed through Stunner, the SFU (LiveKit) sees packets sourced from the relay's container IP — an address it had no candidate for. Its ICE machinery classifies that as peer-reflexive (prflx) and that label propagates back into the candidate-pair stats your browser reports. The transport is still the TURN relay. Cross-check by looking for a relay/udp entry in the LOCAL list whose port matches the pair's local port — that's the real relay candidate; the section below auto-detects this.
TURN creds are fetched per-session from GET /ice with the JWT in Authorization: Bearer …. The sidecar verifies the JWT signature with the shared HMAC secret, then mints username = "<expiry>:<identity>" + password = HMAC-SHA1(secret, username) — the TURN REST API format Stunner's ephemeral auth understands.

Configured iceServers (RTCPeerConnection)

— not connected —

Selected ICE candidate-pair (publisher PC)

— not connected —

All ICE candidates & pairs

LOCAL (this browser)
—
REMOTE (advertised by LiveKit)
—
CANDIDATE PAIRS
—

Event log