Slyber
Pion WebRTC v4 · Simulcast & SVC · WHIP/WHEP · AI Voice Pipe · SFrame E2EE

Deploy an SFU Server in 1 Minute

High-speed selective media router for group video conferences, one-on-one calls, webinars, and conversational AI voice pipelines.

$ curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-sfu-server/main/install.sh | sudo bash
Documentation Slyber SFU on GitHub
Publisher · :4443 simulcast s2 · s1 · s0 Subscriber 1 s2 · 1080p Subscriber 2 s1 · 540p
Single Port 4443 for All Calls
All UDP and RFC 4571 ICE-TCP media traffic is multiplexed over a single port 4443 without opening thousands of firewall ports.
Simulcast, SVC & Last-N Policy
Per-viewer bandwidth adaptation via Simulcast and VP9 SVC, RFC 6464 active speaker detection, and automatic Last-N pausing for silent cameras.
AI Voice Gateway
Built-in full-duplex /ai/ws socket for AI voice agents with a 20ms pacer and instant buffer flush upon human interruption.
SFrame E2EE, Redis & WHIP/WHEP
Authentication via JWT, Redis, or HMAC Secret, SFrame MLS end-to-end encryption with anti-replay protection, and WHIP/WHEP broadcast ingest.
Media Core Architecture

Full Industrial Media Server Capabilities in One Compact Solution

All essential mechanisms of modern real-time video communication from low-level NACK ring buffers to neural audio gateways packed into a single standalone Go binary.

01 / 03
Pion Single-Port Mux

Single UDP & TCP Network Port Powered by Pion WebRTC

Multiplexing all ICE-Lite, DTLS-SRTP, and RFC 4571 ICE-TCP sessions over a single port 4443.

Supports VP9, AV1, H264, VP8, and Opus codecs
Simulcast, SVC & Auto-BWE

Adaptive Simulcast & VP9 SVC Routing

Smart video quality adaptation for each viewer's network and PLI request storm suppression.

Bandwidth estimation via TWCC, REMB, and Receiver Reports
Zero-Alloc & Fast Swap

Zero-Allocation Core & Renegotiation-Free Track Switching

Packet routing without garbage collector overhead and sub-millisecond peer switching.

512-packet history for reverse NACK translation
Full-Duplex AI Voice Pipe

Built-In Audio Gateway for Real-Time AI Conversations

Direct /ai/ws WebSocket gateway for AI voice agents with a 20ms pacer and barge-in detector.

Supports multiple independent AI bots in a single room
SFrame E2EE & 3 Auth Modes

Multi-Layer Security, SFrame E2EE & Flood Protection

Authentication via JWT, Redis, or HMAC Secret, rate limiting, and MLS end-to-end encryption.

Atomic TrafficPolice rate shaper per track and session
WHIP/WHEP, MoQ & Cascade

WHIP/WHEP Broadcast Gateways, MoQ Relay & Inter-Server Cascade

1-RTT broadcast ingest from OBS Studio, MoQ Draft-22 packaging, and secure inter-node cascading.

Cascade SSRF protection blocking local and private subnets
Launch in 4 Steps

How to Deploy and Run Slyber SFU Server

From installing the binary on a clean server to hosting group video calls, OBS streams, and AI voice conversations in under 2 minutes.

01 / 02
STEP 01 · Installation

Install Slyber SFU Server in One Command

The script automatically detects the CPU architecture (amd64 or arm64), verifies the SHA256 checksum, installs the binary to /usr/local/bin/slyber-sfu, and starts the systemd background service.

STEP 01 
curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-sfu-server/main/install.sh | sudo bash
STEP 02 · Configuration & Diagnostics

Verify Node Readiness with the Doctor Utility

Set your server's public IP address and secret keys of at least 24 characters, then run the built-in doctor diagnostics command to instantly verify sockets, security settings, and Redis reachability.

STEP 02 
PUBLIC_IP="99.99.99.99" \
AUTH_MODE="jwt" \
JWT_SECRET="your-24-char-production-jwt-secret" \
NODE_SECRET="your-24-char-production-node-secret" \
slyber-sfu doctor
STEP 03 · Connect Clients & OBS

Connect Participants, Streamers, or AI Bots

Connect browser and mobile applications via the /ws signaling socket or stream live from OBS Studio directly into a room using the standard WHIP protocol without intermediate media servers.

STEP 03 
// 1. WebRTC clients connect to WebSocket signaling:
ws://99.99.99.99:8090/ws (join -> offer/answer -> subscribe_track)

// 2. Or broadcast directly from OBS Studio via WHIP:
POST http://99.99.99.99:8090/whip/live-room/main-camera
Authorization: Bearer <JWT_TOKEN>
STEP 04 · Inspection & Monitoring

Monitor Telemetry and Load in Real Time

Monitor active room counts, bitrate, NACK/PLI events, and AI agent states via the Prometheus /metrics exporter or connect the server to the Slyber Inspector visual test bench.

STEP 04 
curl -H "X-Slyber-Node-Secret: ${NODE_SECRET}" http://127.0.0.1:8090/inspector/stats
# Or open the Slyber Inspector visual test bench on port :8095
Specifications

Full Technical Specifications of Slyber SFU Server

Technical parameters of the media core, supported network protocols, authentication modes, and built-in HTTP and WebSocket gateways.

Network Stack & Default Ports
Pion WebRTC v4 ICE-Lite; single port 4443/UDP (ICEUDPMux) and 4443/TCP (RFC 4571 ICETCPMux); HTTP and WebSocket gateway on port 8090/TCP; 8 MB OS socket buffer
Supported Audio & Video Codecs
Video: VP9 (profile 0 with SVC support), AV1, H264 (level-asymmetry-allowed=1; packetization-mode=1; 42e01f), VP8; Audio: Opus 48000 Hz stereo with Inband FEC
Video Scaling & QoS Mechanisms
Simulcast (up to 3 spatial layers q/h/f) and SVC filtering (3 spatial and 3 temporal layers); NACK ring buffer (512 packets per layer); per-layer PLICoalescer (500ms interval); BWE controller (TWCC, REMB, RTCP RR)
Room Profiles & Last-N Policy
5 profiles (conference, roulette_1v1, broadcast, gaming, ai_voice); active speaker detector via RFC 6464 extension (ssrc-audio-level); automatic pausing of silent video streams via Last-N and Dynacast
Authentication Modes & Traffic Protection
JWT mode (HS256 with expiration and publish/subscribe capability verification), Redis mode (connection pool to slyber:session: keys), Secret mode (HMAC-SHA1); dedicated NODE_SECRET admin key; AtomicTokenBucket rate limiter per track and session
End-to-End Encryption (E2EE)
RFC 9605 SFrame header validation and 16-byte GCM authentication tag check; rotation of up to 16 MLS keys per SSRC; 512-packet RTP anti-replay window; unencrypted RFC 9626 Frame Marking extension inspection
Built-In Broadcast & AI Gateways
WHIP (/whip/{room}/{track}) and WHEP (/whep/{room}/{track}) with Trickle ICE PATCH and ETag owner protection; full-duplex AI Voice Pipe (/ai/ws, single and mux modes up to 8 slots, 20ms pacer, VAD Barge-In); MoQ Relay (/moq/{room}/{track}, moqt-draft-22)
Inter-Server Cascading (Slyber Pipe)
/cascade/ endpoint for linking nodes over UDP; 28-byte header with HMAC-SHA256-128 cryptographic signature and 64-packet anti-replay window; built-in SSRF filter (blocking loopback, RFC 1918, and CGNAT 100.64.0.0/10)
Telemetry, Diagnostics & Integration
JSON stats GET /inspector/stats for Slyber Inspector and Prometheus metrics GET /metrics (lock-free memory reading via runtime/metrics without GC pauses); built-in CLI self-diagnostics slyber-sfu doctor; external TURN integration via EXTERNAL_TURN_URLS
Deployment & Supported Platforms
Single static binary /usr/local/bin/slyber-sfu for Linux and macOS (amd64, arm64); automatic systemd service setup (LimitNOFILE=65535); official Docker image ghcr.io/slyber-app/slyber-sfu-server:latest
Use Cases

Where Slyber SFU Server Delivers Maximum Value

01 / 03
01 Video Conferencing

Enterprise Video Conferencing & Group Calls

Host multi-party calls with automatic HD highlighting of the active speaker and pausing of silent cameras via Last-N policy to save bandwidth and mobile device battery life.

02 1v1 Roulette & Dating

Video Roulettes, Dating Apps & Instant 1-on-1 Chats

Switch between conversation partners in fractions of a millisecond using FastSwapRouletteTrack and packet sequence rewriting without SDP renegotiation or video stalls.

03 Conversational AI

AI Voice Assistants & Group Calls with Bots

Connect Gemini Live and OpenAI voice models directly to rooms over the multiplexed /ai/ws socket with 20ms speech pacing and instant bot interruption when a human starts speaking.

04 Interactive Broadcasting

Interactive Webinars, Auctions & Low-Latency Streaming

Ingest studio streams from OBS Studio via WHIP and simultaneously distribute them to thousands of viewers over WHEP and Simulcast layers with sub-300ms latency.

05 Zero-Trust Security

Confidential Calls with E2EE End-to-End Encryption

Secure rooms for healthcare, fintech, and enterprise teams with enforced SFrame end-to-end encryption validation and MLS key rotation where the media server has zero access to decrypted content.

06 Multi-Region Clustering

Geo-Distributed Clusters & Traffic Cascading

Link multiple servers across different countries over an HMAC-SHA256 signed /cascade/ pipe and package media streams into MoQ Draft-22 format for global CDN delivery.

Knowledge Base & FAQ

Frequently Asked Questions about Slyber SFU Server

Clear, developer-friendly answers to technical questions about SFU architecture, video routing, traffic security, and AI agent integration.

What is an SFU server in simple terms, and why is it needed instead of direct browser-to-browser connections? +
In a standard peer-to-peer connection (Mesh), each participant's browser must send its video stream to every other participant individually. If there are 10 people in a room, your phone encodes and uploads 9 copies of the video stream, rapidly draining the battery and saturating the internet connection. An SFU (Selective Forwarding Unit) solves this problem. You upload your video to the server just once, and Slyber SFU Server instantly forwards the pre-encoded packets to the remaining participants without transcoding video on the server CPU.
Why does Slyber SFU Server require opening only a single media port 4443? +
Traditional media servers allocate a separate random port for every audio and video stream, forcing administrators to open a range of 10,000 or more ports in the firewall. Slyber SFU Server uses the Pion WebRTC v4 stack in ICE-Lite mode with unified ICEUDPMux and ICETCPMux multiplexers. All participants and rooms communicate over a single shared port 4443 via UDP and TCP, while the server automatically inspects and routes packets to their corresponding sessions.
What is the difference between Simulcast and SVC modes, and how does the server adapt to poor internet connections? +
With Simulcast, the sender's browser transmits three independent video streams of different qualities simultaneously, such as 1080p, 540p, and 270p. With SVC (Scalable Video Coding, such as in VP9), all quality layers are packed inside a single stream. The built-in bandwidth controller (Subscriber BWE) continuously measures each viewer's internet speed and packet loss. If a viewer steps into an elevator and their connection degrades, the server smoothly switches only that viewer to the lightweight 270p layer while other participants continue watching in 1080p.
How do Last-N bandwidth savings and active speaker detection work in conferences? +
In large group calls with 20 or 50 people, participants do not need to simultaneously download video from every silent attendee. The active speaker detector in Slyber SFU Server reads the audio level directly from the unencrypted RFC 6464 packet header without decrypting the audio payload itself. The Last-N mechanism automatically keeps video streams active only for the N most recent speakers while pausing cameras of silent participants. As soon as someone starts speaking, the server requests a keyframe and instantly resumes their video without breaking packet sequence numbering.
What does the FastSwapRouletteTrack feature do for video roulettes and 1-on-1 chats? +
In standard WebRTC, switching partners requires re-exchanging large SDP messages and recreating media streams, causing black screens and 1- to 2-second delays. For roulette profiles, Slyber SFU Server provides the roulette_swap command. The server simply switches the internal subscription pointer from the old peer to the new one and recalculates packet sequence offsets via SeqTimestampRewriter. To the viewer's browser, the stream continues seamlessly, and the switch takes less than one millisecond.
Why is SFrame E2EE end-to-end encryption needed if WebRTC already includes built-in SRTP encryption? +
Standard DTLS-SRTP encryption protects traffic in transit between the browser and the server, but packets are decrypted inside the server for routing. When REQUIRE_E2EE is enabled, the payload of every frame is additionally encrypted on the sender's device according to the RFC 9605 SFrame standard with MLS key management. The server validates key authenticity, prevents replay attacks of intercepted packets, and routes video using the unencrypted RFC 9626 Frame Marking extension without being technically able to see the video or hear the audio.
How do I connect an AI voice assistant to a room via the AI Media Pipe gateway? +
The /ai/ws gateway lets you connect any AI voice bot (such as models powered by Gemini Live or OpenAI Realtime) directly into a room over a standard WebSocket without running a complex WebRTC stack on the AI service side. You simply push audio frames into the socket, and the server's built-in pacer aligns them to a 20-millisecond grid and distributes them to people in the room. In mode=mux, a single socket can run up to 6 distinct bots with individual voices. If a human starts speaking and interrupts the bot, the voice activity detector (VAD Barge-In) immediately flushes the bot's playback queue and notifies your backend.
Can multiple Slyber SFU servers be combined into a single cluster for scaling? +
Yes, the server includes a dedicated inter-server cascading gateway /cascade/. You can link multiple Slyber SFU Server nodes across different data centers. When a viewer on Server B subscribes to a publisher's stream from Server A, the nodes establish a secure UDP channel where every packet is signed with an HMAC-SHA256-128 cryptographic tag and validated by built-in SSRF protection against spoofed internal IP addresses.
SFU Architecture & Capabilities Guide

How Slyber SFU Server Works and Why It Is Clear to Every Developer

Building an application with video calls, webinars, or AI voice bots quickly hits the limits of direct peer-to-peer browser connections. Once more than three or four participants join a room, sending video from everyone to everyone overloads the client's CPU and uplink bandwidth. Slyber SFU Server acts as a central media switch. Each participant uploads their audio and video stream to the server just once, and the server selectively forwards packets to the intended viewers based on their network speed, without resource-intensive video decoding on the server side.

Five Key Challenges Slyber SFU Server Solves Out of the Box

You do not need to assemble a complex infrastructure from dozens of fragmented services or open thousands of UDP ports on your host. All functionality is packaged into a single slyber-sfu binary written in Go on top of the Pion WebRTC v4 stack.

  • Single Network Port 4443 for Both UDP and TCP. Thanks to built-in ICE-Lite mode and the unified ICEUDPMux and ICETCPMux multiplexers (RFC 4571), the server accepts connections from thousands of participants on a single port 4443. If a user is behind a corporate network where UDP is blocked, the connection automatically falls back to TCP over the exact same port. For clients behind strict symmetric NATs, the server can automatically issue temporary credentials for an external Slyber TURN Server.
  • Smart Video Quality Adaptation (Simulcast, SVC, and Auto-BWE). A publisher can transmit video in three quality layers simultaneously (low S0, medium S1, and high S2). The SubscriberBWE bandwidth estimation module analyzes TWCC, REMB, and packet loss reports individually for every viewer. A viewer on fast Wi-Fi receives crisp 1080p video, while a user on weak 3G in a subway automatically switches down to the lightweight 270p layer without freezing. Each video layer uses a dedicated PacketRingBuffer for instant retransmission of lost packets upon NACK requests and an independent PLICoalescer filter that shields the publisher from keyframe request storms.
  • Bandwidth Savings in Large Conferences (RFC 6464 & Last-N) and Instant Roulette Swaps. The active speaker detector analyzes voice volume using RFC 6464 RTP header extensions without decrypting the audio stream. In group calls, the EnforceLastNVideo policy automatically pauses video from silent participants, saving up to 80% of downlink bandwidth. For anonymous chats and one-on-one video roulettes, FastSwapRouletteTrack switches a viewer to a new partner in under 1 millisecond while preserving continuous packet sequence numbering via SeqTimestampRewriter without SDP renegotiation.
  • Direct AI Voice Bot Integration via WebSocket Gateway (/ai/ws). To add a voice assistant or a team of AI agents to a room, you do not need to deploy a WebRTC stack in Python or Node.js. Simply connect to the /ai/ws socket with the secret header X-Slyber-Node-Secret. The server extracts raw Opus frames from human microphones in the room and streams them to your bot, while pacing the bot's voice responses on a 20-millisecond timer and broadcasting them back into the room. If a human interrupts the bot by speaking, the VAD Barge-In detector immediately flushes the bot's unspoken audio buffer.
  • WHIP/WHEP Broadcasting, SFrame E2EE End-to-End Encryption, and Server Cascading. Broadcasters can stream directly from OBS Studio via the /whip/{room}/{track} endpoint, while viewers connect in a single round trip via /whep/{room}/{track}. For confidential communications, RFC 9605 SFrame end-to-end encryption validation is supported with MLS key rotation and a 512-packet anti-replay window. When a single machine is not enough, the /cascade/ gateway links multiple servers together over UDP with a cryptographic HMAC-SHA256 signature on every packet.
High-Performance WebRTC SFU Media Server built on Go and Pion

Ready to launch scalable video calls and streaming on your own infrastructure?

Forget complex configurations of tens of thousands of UDP ports and bloated media suites. Deploy the single-binary Slyber SFU Server with Simulcast, VP9 SVC, WHIP/WHEP, and an AI voice bot gateway right now.

Install Documentation