Glossary
Video Conferencing API
Calls inside your product, not a link to someone else’s. A video conferencing API exposes rooms, participants and media tracks so a developer can build voice and video calling into an app, with the media server, signaling and NAT traversal handled for them.
General definition
A Video Conferencing API (also called a video call API or video SDK) packages the hard parts of real-time communication behind a programming interface. Underneath it is almost always WebRTC: the browser and mobile media engine that captures, encodes and encrypts audio and video. The API adds what WebRTC leaves to the application: a signaling service to set calls up, an SFU media server so group calls scale, STUN and TURN for NAT traversal, and identity so that only the right people join the right room.
- Rooms or sessions: a named space that participants join, created and controlled from your backend
- Access tokens: short-lived credentials, usually JWTs, that your server mints so a user can join a specific room with specific permissions
- Tracks: audio, camera video and shared-screen video that participants publish and subscribe to, with mute, quality and layout under app control
- Client SDKs for web, iOS, Android and cross-platform frameworks, plus server-side APIs and webhooks for room events
- Optional services such as recording, live streaming output, transcription and dial-in, each priced and secured separately
Build versus buy turns on how much of that stack you want to own. Building on open-source components (an SFU project, a TURN server, your own signaling) gives full control and no per-minute fees but demands media engineering expertise and operations. Buying a hosted API is fast to integrate and scales without your involvement, at the cost of usage pricing and media transiting a third party. A middle path is a platform you can run in your own cloud account, which keeps the operational burden with the vendor and the data with you.
For telehealth and other regulated uses the checklist is specific. HIPAA requires a Business Associate Agreement with any vendor that handles protected health information, and the enforcement discretion that allowed consumer meeting tools during the pandemic ended in 2023. Media must be encrypted in transit, which WebRTC does with DTLS-SRTP; access must be limited to authenticated participants; and the deployment should support audit trails, data residency and retention rules for anything recorded. A calling API that lives inside an authenticated patient or client app satisfies these more naturally than a standalone meeting link.
In the Ethora ecosystem
Ethora’s voice and video call API adds calling to the same SDK that provides chat and AI agents. Calls are built on WebRTC with an SFU media server, support group calls, and can be enabled as audio-only for products that do not need video. VoIP push wakes the app on iOS and Android for incoming calls, and because participants are the users already provisioned in your app, a call starts from an existing conversation with the identity, room membership and access controls that chat already enforces.
The deployment model is the compliance answer: managed cloud for speed, a dedicated server that Ethora TechOps operate inside your own AWS, DigitalOcean or other cloud account, or fully self-hosted. On Enterprise and dedicated plans Ethora signs a Business Associate Agreement and provides the technical safeguards, TLS and SRTP in transit, encryption at rest, access controls, audit trail and configurable retention, that a healthcare or financial buyer needs to document; the compliance programme itself remains the customer’s. See the healthcare chat SDK page for the wider regulated-industry picture.