Skip to content
CornetaPortuguês

Corneta guides · Guide

Is a stream key a password? RTMP, RTMPS and account security

Treat your stream key like a password: anyone who has the key can stream to your channel. Prefer RTMPS, keep credentials in the system vault and reset the key as soon as you suspect it was exposed.

Published
Reading time
2 min read
Corneta version
0.11.0
Tested with
Corneta 0.6.0 (Windows 11)

The key authorizes the stream

A stream key isn't your login password, but it deserves the same care. Twitch defines the key as the authorization that identifies your channel at the ingest. On YouTube, it links the encoder to the stream you chose.

Enlarge image

Fit
Corneta platform card with the URL and key fields filled in with fictional data.

The URL locates the server; the key authorizes the channel. Corneta keeps the key in the Windows vault.

The URL locates the server; the key authorizes the channel. Corneta keeps the key in the Windows vault.Source: CornetaCorneta version: 0.11.0

Anyone who gets that key can try to send video to your channel without knowing your password. That's why it never goes into a screenshot, a pasted log, a settings backup or a support ticket.

RTMP and RTMPS

RTMP carries the signal to the ingest. RTMPS adds TLS along that path. YouTube recommends RTMPS because the upload stays encrypted all the way to the platform's infrastructure. When the dashboard offers both, prefer rtmps://.

RTMPS doesn't fix a key that has already leaked. It protects the transport; it doesn't stop someone who copied the credential from using it.

If the key showed up on screen

  1. End the suspicious stream.
  2. Reset the key in the platform's dashboard.
  3. Update the key in Corneta.
  4. Review the VOD, clip, screenshot and local recording where it appeared.
  5. Change your account password if there's any sign of a break-in, and turn on 2FA.

To know which field to copy without mixing up the addresses, see stream key, ingest URL and the OBS key.