1# TURN Configuration
2 
3Setup and configuration for Cloudflare TURN service in Workers and applications.
4 
5## Environment Variables
6 
7```bash
8# .env
9CLOUDFLARE_ACCOUNT_ID=your_account_id
10CLOUDFLARE_API_TOKEN=your_api_token
11TURN_KEY_ID=your_turn_key_id
12TURN_KEY_SECRET=your_turn_key_secret
13```
14 
15Validate with zod:
16 
17```typescript
18import { z } from 'zod';
19 
20const envSchema = z.object({
21  CLOUDFLARE_ACCOUNT_ID: z.string().min(1),
22  CLOUDFLARE_API_TOKEN: z.string().min(1),
23  TURN_KEY_ID: z.string().min(1),
24  TURN_KEY_SECRET: z.string().min(1)
25});
26 
27export const config = envSchema.parse(process.env);
28```
29 
30## wrangler.jsonc
31 
32```jsonc
33{
34  "name": "turn-credentials-api",
35  "main": "src/index.ts",
36  "compatibility_date": "2025-01-01",
37  "vars": {
38    "TURN_KEY_ID": "your-turn-key-id"  // Non-sensitive, can be in vars
39  },
40  "env": {
41    "production": {
42      "kv_namespaces": [
43        {
44          "binding": "CREDENTIALS_CACHE",
45          "id": "your-kv-namespace-id"
46        }
47      ]
48    }
49  }
50}
51```
52 
53**Store secrets separately**:
54```bash
55wrangler secret put TURN_KEY_SECRET
56```
57 
58## Cloudflare Worker Integration
59 
60### Worker Binding Types
61 
62```typescript
63interface Env {
64  TURN_KEY_ID: string;
65  TURN_KEY_SECRET: string;
66  CREDENTIALS_CACHE?: KVNamespace;
67}
68 
69export default {
70  async fetch(request: Request, env: Env): Promise<Response> {
71    // See patterns.md for implementation
72  }
73}
74```
75 
76### Basic Worker Example
77 
78```typescript
79export default {
80  async fetch(request: Request, env: Env): Promise<Response> {
81    if (request.url.endsWith('/turn-credentials')) {
82      // Validate client auth
83      const authHeader = request.headers.get('Authorization');
84      if (!authHeader) {
85        return new Response('Unauthorized', { status: 401 });
86      }
87 
88      const response = await fetch(
89        `https://rtc.live.cloudflare.com/v1/turn/keys/${env.TURN_KEY_ID}/credentials/generate`,
90        {
91          method: 'POST',
92          headers: {
93            'Authorization': `Bearer ${env.TURN_KEY_SECRET}`,
94            'Content-Type': 'application/json'
95          },
96          body: JSON.stringify({ ttl: 3600 })
97        }
98      );
99 
100      if (!response.ok) {
101        return new Response('Failed to generate credentials', { status: 500 });
102      }
103 
104      const data = await response.json();
105 
106      // Filter port 53 for browser clients
107      const filteredUrls = data.iceServers.urls.filter(
108        (url: string) => !url.includes(':53')
109      );
110 
111      return Response.json({
112        iceServers: [
113          { urls: 'stun:stun.cloudflare.com:3478' },
114          {
115            urls: filteredUrls,
116            username: data.iceServers.username,
117            credential: data.iceServers.credential
118          }
119        ]
120      });
121    }
122 
123    return new Response('Not found', { status: 404 });
124  }
125};
126```
127 
128## IP Allowlisting (Enterprise/Firewall)
129 
130For strict firewalls, allowlist these IPs for `turn.cloudflare.com`:
131 
132| Type | Address | Protocol |
133|------|---------|----------|
134| IPv4 | 141.101.90.1/32 | All |
135| IPv4 | 162.159.207.1/32 | All |
136| IPv6 | 2a06:98c1:3200::1/128 | All |
137| IPv6 | 2606:4700:48::1/128 | All |
138 
139**IMPORTANT**: These IPs may change with 14-day notice. Monitor DNS:
140 
141```bash
142# Check A and AAAA records
143dig turn.cloudflare.com A
144dig turn.cloudflare.com AAAA
145```
146 
147Set up automated monitoring to detect IP changes and update allowlists within 14 days.
148 
149## IPv6 Support
150 
151- **Client-to-TURN**: Both IPv4 and IPv6 supported
152- **Relay addresses**: IPv4 only (no RFC 6156 support)
153- **TCP relaying**: Not supported (RFC 6062)
154 
155Clients can connect via IPv6, but relayed traffic uses IPv4 addresses.
156 
157## TLS Configuration
158 
159### Supported TLS Versions
160- TLS 1.1
161- TLS 1.2
162- TLS 1.3
163 
164### Recommended Ciphers (TLS 1.3)
165- AEAD-AES128-GCM-SHA256
166- AEAD-AES256-GCM-SHA384
167- AEAD-CHACHA20-POLY1305-SHA256
168 
169### Recommended Ciphers (TLS 1.2)
170- ECDHE-ECDSA-AES128-GCM-SHA256
171- ECDHE-RSA-AES128-GCM-SHA256
172- ECDHE-RSA-AES128-SHA (also TLS 1.1)
173- AES128-GCM-SHA256
174 
175## See Also
176 
177- [api.md](./api.md) - TURN key creation, credential generation API
178- [patterns.md](./patterns.md) - Full Worker implementation patterns
179- [gotchas.md](./gotchas.md) - Security best practices, troubleshooting
180