GuildUSA Architecture

Appearance

API Token Management ​

This section outlines how API secrets are generated, stored, and rotated across the application.

Environment Variables ​

All static API keys (Cloudflare R2, OpenAI, primary Twilio SID) are injected directly into the Laravel .env file on the server. These must never be committed to version control.

Twilio VoIP (Dynamic Tokens) ​

For real-time browser telephony, we do not expose raw API keys to the frontend UI.

  1. The Laravel backend utilizes the Twilio PHP SDK alongside an API Key & Secret.
  2. The backend generates a temporary, cryptographically signed JWT (Access Token) with specific Voice Grants.
  3. The frontend consumes this ephemeral token to establish the WebRTC peer connection.