Whereby

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me embedded video calls that replace Whereby — and know why this is ALMOST.

The thing you are paying for is **calls that connect on any network**. A large share of users sit behind networks where a direct peer connection cannot be made, and without relay servers their call simply does not work — for them, silently, while it works fine for you. That relay is bandwidth, it costs money, and it is the whole verdict.

STACK
- LiveKit or the Jitsi stack as the media server. Do not write one
- coturn for TURN, on its own machine
- Node 20+ with Fastify and SQLite for your own layer: rooms, tokens, recordings, history
- Caddy in front of the web parts

TURN, WHICH IS NOT OPTIONAL
- Run coturn with UDP and TCP, and on port 443 as well — that last one is what gets through corporate firewalls, and without it a meaningful fraction of your users cannot join
- Credentials issued short-lived and per session from your own server, never static. A static TURN credential on the internet becomes somebody else's free relay within days
- Relayed traffic is real bandwidth through your machine: budget roughly a megabit per second per relayed stream in each direction
- Test from a locked-down network, a mobile connection and a hotel wifi before believing anything. A local test tells you nothing about this

CAPACITY
- A selective forwarding server sends each participant's stream to everybody else, so a call of ten is far more than five times a call of two
- Simulcast so a participant on a poor connection receives a lower quality rather than nothing
- Put the media server near the participants. One server in one country serving another continent is a call with a second of delay, and nobody blames the geography
- Monitor bridge load and relay traffic, and alert before saturation rather than after

YOUR OWN LAYER
- rooms: id, slug, name, created_by, starts_at, ends_at, max_participants, is_locked, password_hash, lobby_enabled, recording_enabled, persistent_url
- Short-lived JWTs naming the room, the participant, their display name and whether they moderate. The media server validates the signature; authorisation is your product's decision, not the server's
- participants: id, room_id, name, external_id, joined_at, left_at, was_moderator, connection_quality_json
- recordings: id, room_id, path, bytes, duration_ms, status
- events: id, room_id, kind, actor, at — append-only, so a meeting's history is answerable

THE FEATURE THAT DEFINES THIS PRODUCT
- A persistent room at a stable URL that a person owns: the same address every time, no scheduling, no meeting identifier to send. That is why it is chosen, and it is a slug in a table
- A lobby, so somebody has to be admitted, and a password as well, because a guessable name is a public meeting
- Joining from a browser with no installation and no account. Every extra step loses a participant

EMBEDDING
- An iframe from your own domain, driven by your own token, with your branding and none of the upstream project's
- Control from your own code: mute, remove, lock, end, and knowing who is present
- Screen sharing, chat, raised hands and a participant list — the four things people expect

RECORDING
- A separate process joining as a participant and capturing, then transcoding. Expensive in processor and disk, and the reason hosted plans charge for it. Run it on its own machine and cap the length
- **Every participant is told before they can speak**, visibly. In several jurisdictions recording without notice is unlawful, and quite apart from that it is a betrayal
- Recordings encrypted at rest with a stated retention and a sweeper that deletes

PRIVACY, STATED HONESTLY
- End-to-end encryption where the stack supports it, with the note that a server which cannot see the media cannot record or mix it
- Otherwise the media is encrypted in transit and decrypted at your own server. Say exactly that rather than claiming more
- No analytics inside a call

OPERATIONS
- .env: DATABASE_PATH, BASE_URL, JWT_SECRET, MEDIA_SERVER_URL, TURN_SECRET, RECORDING_PATH
- Migrations on boot, each once; nightly backup of your own database
- Health endpoint checking the media server and the relay

WHAT MATTERS MOST
TURN on port 443 and short-lived credentials. Test a call from a restrictive corporate network before building anything of your own — a meeting product that silently fails for a quarter of its users has failed completely, and that quarter never tells you why.