By default a fresh Jitsi server lets anyone who knows its address create a meeting. That is fine for a demo and a problem in production: your bandwidth, your domain, somebody else’s meeting.
The “secure domain” setup fixes it. Hosts log in to start a room; everyone else joins with the link once the host is there.
1. Enable internal authentication
In .env:
ENABLE_AUTH=1
AUTH_TYPE=internal
ENABLE_GUESTS=1ENABLE_GUESTS=1 keeps meeting links usable by people without an account. Set it to 0 if every participant should log in.
Recreate the containers so Prosody and the web config pick up the change:
docker compose up -d --force-recreate2. Create host accounts
Users live in Prosody. The internal XMPP domain on the Docker setup is meet.jitsi, not your public hostname:
docker compose exec prosody prosodyctl --config /config/prosody.cfg.lua register alice meet.jitsi 'a-strong-password'Remove a user:
docker compose exec prosody prosodyctl --config /config/prosody.cfg.lua unregister alice meet.jitsi3. What users see
- A host opens a room, clicks I am the host, and signs in with their Prosody username and password.
- Anyone else who opens the link before a host arrives waits for the host.
- Once the host is in, guests join normally.
4. Add a lobby and room passwords
Authentication controls who can start rooms. For who can enter a specific meeting, the moderator has two tools in the security menu:
- Lobby: people knock and the moderator admits them one by one.
- Room password: only people with the password get in.
Enable the lobby by default for every room in .env:
ENABLE_LOBBY=15. Make room names hard to guess
Even with authentication, a guessable room name like /sales invites unwanted guests once a host is in. Generate random room names for sensitive meetings, or use JWT so each person needs a token for that exact room.
When to choose JWT instead
Internal accounts work well for a handful of hosts. If your users already log in to your own app, JWT is cleaner: your backend issues a token per person and per room, with no separate Jitsi passwords to manage.
Summary
Three lines in .env, one command per host, and your server stops being a free public meeting service. If you want this, plus lobbies, JWT and sensible defaults, configured and tested for you, our support team can do it in a single session.