refactor: extract access tokens into livekit-token

Moves access_token.rs, jwt_provider.rs and the test_token.txt fixture,
plus the get_env_keys helper, into a new livekit-token crate. livekit-api
re-exports it as `access_token`, which stays the documented path, so no
consumer changes.

Also fixes services-tokio and services-async, which used the access-token
types without declaring the access-token feature: building with
--no-default-features --features services-tokio failed to compile. The
extraction forces the fix, since services/ can no longer reach the types
any other way.

Adds livekit-api/tests/backcompat_paths.rs, a compile-only guard on the
re-export paths, since nothing else in the workspace imports them.

Also records in the implementation plan that test_token.txt has to move
with the token code; the plan had missed it, and cargo test -p
livekit-token fails without it.

Author: 1egoman

.changeset/extract_livekit_token_crate.md

@@ -0,0 +1,11 @@
+---
+livekit-api: patch
+---
+
+Moves access-token generation and verification into a new `livekit-token` crate.
+`livekit_api::access_token::*` continues to resolve to the same types via a
+re-export, so no consumer changes are needed.
+
+Also fixes the `services-tokio` and `services-async` features, which used the
+access-token types without declaring the `access-token` feature. Building with
+`--no-default-features --features services-tokio` previously failed to compile.

Cargo.lock

@@ -9,6 +9,7 @@ members = [
     "livekit-ffi",
     "livekit-uniffi",
     "livekit-datatrack",
+    "livekit-token",
     "livekit-token-source",
     "livekit-ffi-node-bindings",
     "livekit-net",
@@ -54,6 +55,7 @@ livekit = { version = "0.8.3", path = "livekit" }
 livekit-api = { version = "0.6.3", path = "livekit-api" }
 livekit-ffi = { version = "0.12.75", path = "livekit-ffi" }
 livekit-datatrack = { version = "0.1.13", path = "livekit-datatrack" }
+livekit-token = { version = "0.1.0", path = "livekit-token" }
 livekit-token-source = { version = "0.1.1", path = "livekit-token-source" }
 livekit-common = { version = "0.1.1", path = "livekit-common" }
 livekit-data-stream = { version = "0.1.2", path = "livekit-data-stream" }

Cargo.toml

@@ -85,6 +85,15 @@ versioned_files = [
 changelog = "livekit-net/CHANGELOG.md"
 scopes = ["livekit-net"]
 
+[packages.livekit-token]
+versioned_files = [
+  "livekit-token/Cargo.toml",
+  "Cargo.lock",
+  { path = "Cargo.toml", dependency = "livekit-token" },
+]
+changelog = "livekit-token/CHANGELOG.md"
+scopes = ["livekit-token"]
+
 [packages.libwebrtc]
 versioned_files = [
   "libwebrtc/Cargo.toml",

knope.toml

@@ -31,9 +31,9 @@ signal-client-tokio      = ["signal-client", "livekit-net/native-tokio", "liveki
 signal-client-async      = ["signal-client", "livekit-net/native-async",      "livekit-runtime/async"]
 signal-client-dispatcher = ["signal-client", "livekit-net/native-dispatcher",  "livekit-runtime/dispatcher"]
 
-services-tokio = ["dep:reqwest", "dep:tokio", "tokio/time", "dep:livekit-runtime", "livekit-runtime/tokio"]
-services-async = ["dep:isahc", "dep:livekit-runtime", "livekit-runtime/async"]
-access-token = ["dep:jsonwebtoken", "dep:hmac", "dep:signature"]
+services-tokio = ["access-token", "dep:reqwest", "dep:tokio", "tokio/time", "dep:livekit-runtime", "livekit-runtime/tokio"]
+services-async = ["access-token", "dep:isahc", "dep:livekit-runtime", "livekit-runtime/async"]
+access-token = ["dep:livekit-token"]
 webhooks = ["access-token", "dep:serde_json", "dep:base64"]
 
 # TLS Configuration
@@ -71,6 +71,7 @@ __rustls-tls            = ["livekit-net?/__rustls-tls",             "reqwest?/__
 [dependencies]
 livekit-net = { workspace = true, optional = true }
 livekit-protocol = { workspace = true }
+livekit-token = { workspace = true, optional = true }
 livekit-common = { workspace = true }
 thiserror = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
@@ -85,12 +86,6 @@ pbjson-types = "0.6"
 serde_json = { workspace = true, optional = true }
 base64 = { version = "0.21", optional = true, features = ["std"] }
 
-# access_token: HS256 only, via the in-crate HMAC CryptoProvider (jwt_provider.rs).
-# Dropping jsonwebtoken's rust_crypto bundle avoids linking RSA/EC/EdDSA.
-jsonwebtoken = { version = "10", default-features = false, optional = true }
-hmac = { version = "0.12", optional = true }
-signature = { version = "2", optional = true }
-
 # signal_client
 livekit-runtime = { workspace = true, optional = true, default-features = false }
 tokio = { workspace = true, default-features = false, features = ["sync", "macros", "signal", "io-util", "net"], optional = true }

livekit-api/Cargo.toml

@@ -14,11 +14,11 @@
 
 #![doc = include_str!("../README.md")]
 
+// The token implementation lives in the livekit-token crate. This alias keeps
+// the historical `livekit_api::access_token::*` paths working, and remains the
+// documented, supported way to reach these types.
 #[cfg(feature = "access-token")]
-pub mod access_token;
-
-#[cfg(feature = "access-token")]
-mod jwt_provider;
+pub use livekit_token as access_token;
 
 #[cfg(any(feature = "services-tokio", feature = "services-async"))]
 pub mod services;
@@ -37,10 +37,3 @@ mod region;
 
 #[cfg(feature = "webhooks")]
 pub mod webhooks;
-
-#[allow(dead_code)]
-pub(crate) fn get_env_keys() -> Result<(String, String), std::env::VarError> {
-    let api_key = std::env::var("LIVEKIT_API_KEY")?;
-    let api_secret = std::env::var("LIVEKIT_API_SECRET")?;
-    Ok((api_key, api_secret))
-}

livekit-api/src/lib.rs

@@ -13,12 +13,9 @@
 // limitations under the License.
 
 use super::{twirp_client::TwirpClient, ServiceBase, ServiceResult, LIVEKIT_PACKAGE};
-use crate::{
-    access_token::{AccessTokenError, VideoGrants},
-    get_env_keys,
-};
 use http::header::HeaderMap;
 use livekit_protocol as proto;
+use livekit_token::{get_env_keys, AccessTokenError, VideoGrants};
 
 const SVC: &str = "AgentDispatchService";
 

livekit-api/src/services/agent_dispatch.rs

@@ -35,7 +35,7 @@ use super::failover::FailoverConfig;
 use super::sip::CreateSIPParticipantOptions;
 use super::twirp_client::{ServerError, ServerResult, TwirpClient};
 use super::{LiveKitApi, ServiceError, SipCallError, LIVEKIT_PACKAGE};
-use crate::access_token::{AccessToken, VideoGrants};
+use livekit_token::{AccessToken, VideoGrants};
 
 fn base_url() -> String {
     std::env::var("LK_TEST_SERVER_URL").unwrap_or_else(|_| "http://127.0.0.1:9999".to_owned())

livekit-api/src/services/api_test.rs

@@ -18,7 +18,8 @@ use std::time::Duration;
 
 use super::{ServiceBase, ServiceResult, LIVEKIT_PACKAGE};
 use crate::services::dial_timeout::DEFAULT_RINGING_TIMEOUT;
-use crate::{access_token::VideoGrants, get_env_keys, services::twirp_client::TwirpClient};
+use crate::services::twirp_client::TwirpClient;
+use livekit_token::{get_env_keys, VideoGrants};
 
 const SVC: &str = "Connector";
 

livekit-api/src/services/connector.rs

@@ -15,7 +15,8 @@
 use livekit_protocol as proto;
 
 use super::{ServiceBase, ServiceResult, LIVEKIT_PACKAGE};
-use crate::{access_token::VideoGrants, get_env_keys, services::twirp_client::TwirpClient};
+use crate::services::twirp_client::TwirpClient;
+use livekit_token::{get_env_keys, VideoGrants};
 
 #[derive(Clone, Copy, Debug, Default)]
 pub enum AudioMixing {