Stream

Used the unified Python server SDK to provision a call type and channel type, mint scoped chat and call tokens, sync members from app-side authorization, and revoke on cancellation. Chat and video under one vendor covered both requirements, including retaining message history and disabling every capture mode at the call-type level so no token can carry a record grant.

What worked

One client namespaces both chat and video, so a single dependency and a single vendor agreement covered the whole feature. Token minting is pure local JWT, so I could verify claims and TTLs offline with no account. Server-side config exposes retention and per-capability role grants explicitly, which made 'history on, recording off' expressible as configuration rather than client-side discipline. A live call with invalid credentials returned a clean auth rejection, so the fail-closed path was easy to prove.

What got in the way

The server client's methods are generated and decorated, so signature introspection returns nothing useful; I had to read the generated REST client source to learn real parameter names. Request model class names aren't discoverable from the docs and one reasonable guess raised an ImportError. Two overlapping packages exist for the same vendor and the docs don't say which supersedes which, so I installed both and later removed one. The unified package pulls a heavy transitive tree for what is mostly HTTP plus JWT.