> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/bluenviron/gortsplib/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Connect to RTSPS servers and enable SRTP/SRTCP encryption.

## Credentials in the URL

Pass a username and password directly in the RTSP URL. gortsplib extracts and retains the credentials for authentication challenges (Basic and Digest).

```go theme={null}
u, err := base.ParseURL("rtsp://myuser:mypass@localhost:8554/mystream")
```

The `user:pass@` portion is forwarded on every request that requires authentication. You do not need to configure anything else for plain credential-based auth.

## RTSPS (TLS)

Use an `rtsps://` URL and supply a `*tls.Config` to connect to a server that requires TLS. The default RTSPS port is `322`; gortsplib adds it automatically when no port is specified in the URL.

```go theme={null}
import (
    "crypto/tls"

    "github.com/bluenviron/gortsplib/v5"
    "github.com/bluenviron/gortsplib/v5/pkg/base"
)

u, err := base.ParseURL("rtsps://myuser:mypass@localhost:322/mystream")
if err != nil {
    panic(err)
}

c := gortsplib.Client{
    Scheme: u.Scheme, // "rtsps"
    Host:   u.Host,
    TLSConfig: &tls.Config{
        // supply your CA pool, client certificates, etc.
    },
}

err = c.Start()
if err != nil {
    panic(err)
}
defer c.Close()
```

### Self-signed certificates

If the server uses a self-signed certificate and you accept the security implications, set `InsecureSkipVerify`:

```go theme={null}
c := gortsplib.Client{
    Scheme: u.Scheme,
    Host:   u.Host,
    TLSConfig: &tls.Config{
        InsecureSkipVerify: true, //nolint:gosec
    },
}
```

<Warning>
  `InsecureSkipVerify: true` disables certificate chain and hostname verification. Any server can present any certificate and the client will accept it. Use this only in controlled, non-production environments.
</Warning>

## SRTP / SRTCP

SRTP (Secure RTP) encrypts RTP and RTCP packets at the media layer. When the server advertises SRTP in its SDP (the transport profile is `RTP/SAVP`), gortsplib enables SRTP automatically — no additional configuration is required.

The library handles:

* Key exchange via MIKEY (embedded in the SDP `key-mgmt` attribute)
* Encryption and decryption of RTP and RTCP payloads
* SRTP context lifecycle tied to the session

<Info>
  SRTP is independent of TLS. A server can require SRTP without using `rtsps://`, and an `rtsps://` server does not necessarily use SRTP. Many deployments use both together for defense in depth.
</Info>

## Tunneling for firewall traversal

When a firewall blocks the RTSP port (554), you can tunnel the RTSP connection inside HTTP or WebSocket by setting the `Tunnel` field:

```go theme={null}
c := gortsplib.Client{
    Scheme: u.Scheme,
    Host:   u.Host,
    Tunnel: gortsplib.TunnelHTTP,      // or gortsplib.TunnelWebSocket
}
```

For a full walkthrough of proxy and tunneling scenarios, see the [proxy guide](/guides/proxy).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.