01 — TURN FOR AI AGENTS
Your voice, video and vision agents reach users over WebRTC. When a firewall, an office network or a mobile carrier blocks the direct path, Metered relays the media over UDP and TCP on ports 80 and 443, and TLS on port 443.
500 MB free every month. No credit card required.
User
office Wi-Fi · UDP blocked
AI agent
speech-to-text → LLM → text-to-speech
Sure, I can move your appointment to Friday.
02 — DO YOU NEED TURN?
An AI agent needs a TURN server when its WebRTC media can't travel directly between the user and the agent. That happens when the user sits behind a firewall that blocks UDP, or when the agent runs without a public IP. A TURN relay gives both sides a reachable meeting point on ports 80 and 443.
| YOUR SETUP | TURN SERVER? | WHY |
|---|---|---|
| The browser talks straight to the OpenAI Realtime API over WebRTC | Not needed | OpenAI terminates WebRTC on its own publicly reachable servers, and its WebRTC guide doesn't ask you for STUN or TURN. |
| Gemini Live API | Not needed | The Live API streams over WebSockets, not WebRTC. |
| Your own agent server terminates WebRTC (aiortc, Pipecat's SmallWebRTC transport, FastRTC) | Yes | Users behind firewalls that block UDP can only reach your agent through a relay over TCP on ports 80 and 443 or TLS on port 443. |
| The agent runs in a container or VPC without a public IP | Yes | Both ends sit behind NAT. A relay is the address they can both reach. |
| Amazon Bedrock AgentCore with WebRTC | Required | AWS requires a TURN relay for media between the client and the agent. TURN for AgentCore WebRTC |
| An AI avatar or video agent you host yourself | Usually | Same reasons as a self-hosted voice agent, with more media per session. |
03 — ARCHITECTURE
A voice agent is a WebRTC peer. The user's browser or app streams microphone audio to the agent, and the agent streams its spoken reply back. When the direct path fails, both sides send that media through a TURN relay instead.
The relay only moves packets. Your speech-to-text, LLM and text-to-speech stay wherever you run them.
VOICE AGENT MEDIA PATH
The relay forwards media packets. Speech-to-text, the LLM and text-to-speech run wherever you deploy them.
04 — BUILT FOR AGENTS
What a WebRTC agent needs from its relay: a way through restrictive networks, servers close to your users, and credentials your code can manage.
TURN over TCP on ports 80 and 443 and TLS on port 443 reaches users on office, school and hospital networks that block UDP.
Automatic geo-routing sends each session to the nearest of 31+ relay regions, so the relay adds as little distance as possible.
Create TURN credentials with an optional expiry, then fetch the ready-made ICE server list for any session. Each credential's API key covers that one credential.
Label credentials and pull daily usage for each one, so you can attribute relay traffic to a customer, an agent or an environment.
Choose a specific region for data residency compliance.
Media passes through the relay still encrypted by WebRTC. Metered holds no keys and never inspects, stores or records it. Connection metadata, including IP addresses, is kept for 30 days.
05 — USE CASES
Support, scheduling and sales agents that talk to people in a browser or an app. Callers on corporate Wi-Fi or a mobile carrier still connect.
Avatars and video agents stream far more data per session than voice, so a relay close to the user matters even more.
Agents that watch a camera feed or a shared screen receive the video over WebRTC, even when the camera sits behind a NAT you don't control.
AgentCore Runtime requires a TURN relay for WebRTC. See how to connect Metered TURN to an AgentCore agent.
TURN for AgentCore WebRTC06 — PLANS
Prototype your agent on the free trial, then move to the plan, or the contract, that fits your traffic.
STARTUPS AND GROWING TEAMS
07 — RESOURCES
Connect Metered TURN to an AgentCore WebRTC agent, with example code and a VPC egress checklist.
Read the guideA WebRTC voice agent in Python: join a room, run speech-to-text, an LLM and text-to-speech, then speak the reply.
Open the tutorialFetch the ICE server list for a credential: STUN, plus TURN over UDP, TCP and TLS.
API referenceIssue expiring credentials on a schedule without cutting off calls that are already running.
Read the guidePoint a credential or a request at a specific region when your data-residency rules call for it.
Read the guideMachine-readable TURN docs your coding assistant can use, including llms-turn-server.txt.
08 — FAQ
Stream takes it as rtc_configuration, and FastRTC's deployment guide notes that cloud hosts such as Hugging Face Spaces need a TURN server. Pipecat takes it as ice_servers on SmallWebRTCConnection, which its SmallWebRTC transport wraps.
Start with 500 MB of TURN every month, free. Move to a paid plan when your agents go to production.