# Secure channel encryption (/en/realtime-media/broadcast-streaming/build/secure-and-protect-channels/media-stream-encryption/macos)

> For AI agents: see the complete documentation index at [llms.txt](/llms.txt).

Media stream encryption encrypts audio and video streams with a unique [key](https://en.wikipedia.org/wiki/Public_key_certificate) and [salt](https://en.wikipedia.org/wiki/Salt_%28cryptography%29) controlled by your app server. Encryption ensures that only authorized users in a channel can see and hear each other. RTC SDK provides built-in encryption methods that you can use to guarantee data confidentiality during transmission.

This article describes how to integrate Agora built-in media stream encryption into your app.

## Understand the tech

The following figure illustrates data transfer with media stream encryption enabled.

**Data transfer process**

      
  
      
  
      
![Encrypted media stream transfer process](https://assets-docs.agora.io/images/video-sdk/encrypt_media_streams_dataTransferProcess.svg)

    
  
      
  
      
  
      
  
      
  
      
  
      
  
## Prerequisites

Ensure that you have implemented the [SDK quickstart](../../index) in your project.

## Implement media stream encryption

      
  
      
  
      
To add built-in media stream encryption to your app, refer to the following steps.

1. Generate a key and salt on your server.

   To generate a random 32-byte hexadecimal key on your server as a string, run:

   ```bash
   openssl rand -hex 32
   ```

   To generate a random Base64-encoded, 32-byte salt on your server, run:

   ```bash
   openssl rand -base64 32
   ```

2. Implement client-side logic.

<CalloutContainer type="info">
  <CalloutDescription>
    All users in a channel must use the same encryption mode, key, and salt. Discrepancies may lead to unexpected behavior, such as black screens or audio loss.

    To ensure security, use a new key and salt each time you enable media stream encryption.
  </CalloutDescription>
</CalloutContainer>

Manually add the encryption library to your project or integrate it with CocoaPods, then call `enableEncryption` before joining a channel. Set the encryption mode to `AgoraEncryptionModeAES128GCM2` or `AgoraEncryptionModeAES256GCM2` and pass the key and salt to the SDK.

```swift
import AgoraRtcCryptoLoader

func getEncryptionSaltFromServer() -> Data {
  let base64Salt = "EncryptionKdfSaltInBase64Strings"
  return Data(base64Encoded: base64Salt)!
}

let config = AgoraEncryptionConfig()
config.encryptionMode = .AES128GCM2
config.encryptionKdfSalt = getEncryptionSaltFromServer()
config.encryptionKey = getEncryptionKeyFromServer()

let result = agoraKit.enableEncryption(true, encryptionConfig: config)
if result != 0 {
  print("enableEncryption failed: \(result)")
}
```

## Reference

### Sample project

* [StreamEncryption for iOS](https://github.com/AgoraIO/API-Examples/tree/main/iOS/APIExample/APIExample/Examples/Advanced/StreamEncryption)
* [StreamEncryption for macOS](https://github.com/AgoraIO/API-Examples/tree/main/macOS/APIExample/Examples/Advanced/StreamEncryption)

### API reference

* [`enableEncryption`](https://api-ref.agora.io/en/video-sdk/ios/4.x/documentation/agorartckit/agorartcenginekit/enableencryption%28_\:encryptionconfig:%29)
* [`AgoraEncryptionConfig`](https://api-ref.agora.io/en/video-sdk/ios/4.x/documentation/agorartckit/agoraencryptionconfig)