# Require a login to create Jitsi rooms (secure domain)

> On Docker, set ENABLE_AUTH=1, AUTH_TYPE=internal and ENABLE_GUESTS=1 in .env, recreate the containers, then create accounts with docker compose exec prosody prosodyctl --config /config/prosody.cfg.lua register USER meet.jitsi PASSWORD. Only those users can start rooms; guests can still join once a host is in.

Source: https://jitsi.help/guides/jitsi-secure-domain-authentication/
Updated: September 26, 2026
Publisher: Jitsi Help (https://jitsi.help/)

By default a fresh Jitsi server lets anyone who knows its address create a meeting. That is fine for a demo and a problem in production: your bandwidth, your domain, somebody else's meeting.

The "secure domain" setup fixes it. Hosts log in to start a room; everyone else joins with the link once the host is there.

## 1. Enable internal authentication

In `.env`:

```ini
ENABLE_AUTH=1
AUTH_TYPE=internal
ENABLE_GUESTS=1
```

`ENABLE_GUESTS=1` keeps meeting links usable by people without an account. Set it to `0` if every participant should log in.

Recreate the containers so Prosody and the web config pick up the change:

```bash
docker compose up -d --force-recreate
```

## 2. Create host accounts

Users live in Prosody. The internal XMPP domain on the Docker setup is `meet.jitsi`, not your public hostname:

```bash
docker compose exec prosody prosodyctl --config /config/prosody.cfg.lua register alice meet.jitsi 'a-strong-password'
```

Remove a user:

```bash
docker compose exec prosody prosodyctl --config /config/prosody.cfg.lua unregister alice meet.jitsi
```

## 3. What users see

- A host opens a room, clicks **I am the host**, and signs in with their Prosody username and password.
- Anyone else who opens the link before a host arrives waits for the host.
- Once the host is in, guests join normally.

## 4. Add a lobby and room passwords

Authentication controls who can **start** rooms. For who can **enter** a specific meeting, the moderator has two tools in the security menu:

- **Lobby:** people knock and the moderator admits them one by one.
- **Room password:** only people with the password get in.

Enable the lobby by default for every room in `.env`:

```ini
ENABLE_LOBBY=1
```

## 5. Make room names hard to guess

Even with authentication, a guessable room name like `/sales` invites unwanted guests once a host is in. Generate random room names for sensitive meetings, or use [JWT](/guides/jitsi-jwt-authentication/) so each person needs a token for that exact room.

## When to choose JWT instead

Internal accounts work well for a handful of hosts. If your users already log in to your own app, JWT is cleaner: your backend issues a token per person and per room, with no separate Jitsi passwords to manage.

## Summary

Three lines in `.env`, one command per host, and your server stops being a free public meeting service. If you want this, plus lobbies, JWT and sensible defaults, configured and tested for you, our [support team](/services/jitsi-support/) can do it in a single session.

## Frequently asked questions

### Why does anyone need to lock down a Jitsi server?

An open Jitsi server lets anyone who finds it host meetings on your bandwidth. Public servers get discovered and abused, sometimes for content you would not want associated with your domain. Requiring a login to create rooms stops that while keeping links shareable.

### What is the difference between a room password and authentication?

A room password is set by the moderator inside one meeting and protects only that room. Authentication decides who is allowed to create rooms on the server at all. Most servers want both: authentication for hosts, and a password or lobby for sensitive meetings.

### Should I use internal authentication or JWT?

Internal authentication suits a small, fixed group of hosts who can remember a username and password. JWT suits anything integrated with your own app or user database, because your backend grants access without separate Jitsi accounts.


---

Jitsi Help is an independent service. It is not affiliated with, endorsed by or sponsored by 8x8, Inc. or the Jitsi project. Jitsi and Jitsi Meet are trademarks of 8x8, Inc., used here only to describe the software we host and support.