diff --git a/sylk/applications/webrtcgateway/models/sylkrtc.py b/sylk/applications/webrtcgateway/models/sylkrtc.py
index dff85f9..6dd747f 100644
--- a/sylk/applications/webrtcgateway/models/sylkrtc.py
+++ b/sylk/applications/webrtcgateway/models/sylkrtc.py
@@ -1,547 +1,552 @@
 
 from application.python import subclasses
 
 from .jsonobjects import BooleanProperty, IntegerProperty, StringProperty, ArrayProperty, ObjectProperty, FixedValueProperty, LimitedChoiceProperty, AbstractObjectProperty
 from .jsonobjects import JSONObject, JSONArray, StringArray, CompositeValidator
 from .validators import AORValidator, DisplayNameValidator, LengthValidator, UniqueItemsValidator
 
 from sipsimple.util import ISOTimestamp
 
 # Base models (these are abstract and should not be used directly)
 
 class SylkRTCRequestBase(JSONObject):
     transaction = StringProperty()
 
 
 class SylkRTCResponseBase(JSONObject):
     transaction = StringProperty()
 
 
 class AccountRequestBase(SylkRTCRequestBase):
     account = StringProperty(validator=AORValidator())
 
 
 class SessionRequestBase(SylkRTCRequestBase):
     session = StringProperty()
 
 
 class VideoroomRequestBase(SylkRTCRequestBase):
     session = StringProperty()
 
 
 class AccountEventBase(JSONObject):
     sylkrtc = FixedValueProperty('account-event')
     account = StringProperty(validator=AORValidator())
 
 
 class SessionEventBase(JSONObject):
     sylkrtc = FixedValueProperty('session-event')
     session = StringProperty()
 
 
 class VideoroomEventBase(JSONObject):
     sylkrtc = FixedValueProperty('videoroom-event')
     session = StringProperty()
 
 
 class AccountRegistrationStateEvent(AccountEventBase):
     event = FixedValueProperty('registration-state')
 
 
 class SessionStateEvent(SessionEventBase):
     event = FixedValueProperty('state')
 
 
 class VideoroomSessionStateEvent(VideoroomEventBase):
     event = FixedValueProperty('session-state')
 
 
 # Miscellaneous models
 
 class SIPIdentity(JSONObject):
     uri = StringProperty(validator=AORValidator())
     display_name = StringProperty(optional=True, validator=DisplayNameValidator())
 
 
 class ICECandidate(JSONObject):
     candidate = StringProperty()
     sdpMLineIndex = IntegerProperty()
     sdpMid = StringProperty()
 
 
 class ICECandidates(JSONArray):
     item_type = ICECandidate
 
 
 class AORList(StringArray):
     list_validator = UniqueItemsValidator()
     item_validator = AORValidator()
 
 
 class VideoroomPublisher(JSONObject):
     id = StringProperty()
     uri = StringProperty(validator=AORValidator())
     display_name = StringProperty(optional=True)
 
 
 class VideoroomPublishers(JSONArray):
     item_type = VideoroomPublisher
 
 
 class VideoroomActiveParticipants(StringArray):
     list_validator = CompositeValidator(UniqueItemsValidator(), LengthValidator(maximum=2))
 
 
 class VideoroomSessionOptions(JSONObject):
     audio = BooleanProperty(optional=True)
     video = BooleanProperty(optional=True)
     bitrate = IntegerProperty(optional=True)
 
 
 class VideoroomRaisedHands(StringArray):
     list_validator = UniqueItemsValidator()
 
 
 class SharedFile(JSONObject):
     filename = StringProperty()
     filesize = IntegerProperty()
     uploader = ObjectProperty(SIPIdentity)  # type: SIPIdentity
     session = StringProperty()
 
 
 class SharedFiles(JSONArray):
     item_type = SharedFile
 
 
 class DispositionNotifications(StringArray):
     list_validator = UniqueItemsValidator()
 
 
 class Message(JSONObject):
-    contact = StringProperty()  # type: SIPIdentity
+    contact = StringProperty(validator=AORValidator())
     timestamp = StringProperty()
     disposition = ArrayProperty(DispositionNotifications, optional=True)
     message_id = StringProperty()
     content_type = StringProperty()
     content = StringProperty()
     direction = StringProperty(optional=True)
     state = LimitedChoiceProperty(['delivered', 'failed', 'displayed', 'forbidden', 'error', 'accepted', 'pending', 'received'], optional=True)
 
     def __init__(self, **kw):
         if 'msg_timestamp' in kw:
             kw['timestamp'] = str(ISOTimestamp(kw['msg_timestamp']))
             del kw['msg_timestamp']
         super(Message, self).__init__(**kw)
 
 
 class ContactMessages(JSONArray):
     item_type = Message
 
 
+class MessageHistoryData(JSONObject):
+    account = StringProperty(validator=AORValidator())
+    messages = ArrayProperty(ContactMessages)
+
+
 class AccountMessageRemoveEventData(JSONObject):
     contact = StringProperty()
     message_id = StringProperty()
 
 
 class AccountConversationRemoveEventData(JSONObject):
     contact = StringProperty()
 
 
 class AccountDispositionNotificationEventData(JSONObject):
     message_id = StringProperty()
     state = LimitedChoiceProperty(['accepted', 'delivered', 'displayed', 'failed', 'processed', 'stored', 'forbidden', 'error'])
     message_timstamp = StringProperty()
     code = IntegerProperty()
     reason = StringProperty()
 
 # Response models
 
 class AckResponse(SylkRTCResponseBase):
     sylkrtc = FixedValueProperty('ack')
 
 
 class ErrorResponse(SylkRTCResponseBase):
     sylkrtc = FixedValueProperty('error')
     error = StringProperty()
 
 
 # Connection events
 
 class ReadyEvent(JSONObject):
     sylkrtc = FixedValueProperty('ready-event')
 
 
 # Account events
 
 class AccountIncomingSessionEvent(AccountEventBase):
     event = FixedValueProperty('incoming-session')
     session = StringProperty()
     originator = ObjectProperty(SIPIdentity)  # type: SIPIdentity
     sdp = StringProperty()
     call_id = StringProperty()
 
 
 class AccountMissedSessionEvent(AccountEventBase):
     event = FixedValueProperty('missed-session')
     originator = ObjectProperty(SIPIdentity)  # type: SIPIdentity
 
 
 class AccountConferenceInviteEvent(AccountEventBase):
     event = FixedValueProperty('conference-invite')
     room = StringProperty(validator=AORValidator())
     session_id = StringProperty()
     originator = ObjectProperty(SIPIdentity)  # type: SIPIdentity
 
 
 class AccountMessageEvent(AccountEventBase):
     event = FixedValueProperty('message')
     sender = ObjectProperty(SIPIdentity)  # type: SIPIdentity
     timestamp = StringProperty()
     disposition_notification = ArrayProperty(DispositionNotifications, optional=True)
     message_id = StringProperty()
     content_type = StringProperty()
     content = StringProperty()
     direction = StringProperty(optional=True)
 
 
 class AccountDispositionNotificationEvent(AccountEventBase):
     event = FixedValueProperty('disposition-notification')
     message_id = StringProperty()
     message_timestamp = StringProperty()
     state = LimitedChoiceProperty(['accepted', 'delivered', 'displayed', 'failed', 'processed', 'stored', 'forbidden', 'error'])
     code = IntegerProperty()
     reason = StringProperty()
 
 
 class AccountSyncConversationsEvent(AccountEventBase):
     event = FixedValueProperty('sync-conversations')
     messages = ArrayProperty(ContactMessages)
 
 
 class AccountSyncEvent(AccountEventBase):
     event = FixedValueProperty('sync')
     type = StringProperty()
     action = StringProperty()
     content = AbstractObjectProperty()
 
 
 class AccountRegisteringEvent(AccountRegistrationStateEvent):
     state = FixedValueProperty('registering')
 
 
 class AccountRegisteredEvent(AccountRegistrationStateEvent):
     state = FixedValueProperty('registered')
 
 
 class AccountRegistrationFailedEvent(AccountRegistrationStateEvent):
     state = FixedValueProperty('failed')
     reason = StringProperty(optional=True)
 
 
 # Session events
 
 class SessionProgressEvent(SessionStateEvent):
     state = FixedValueProperty('progress')
 
 
 class SessionEarlyMediaEvent(SessionStateEvent):
     state = FixedValueProperty('early-media')
     sdp = StringProperty(optional=True)
     call_id = StringProperty(optional=True)
 
 
 class SessionAcceptedEvent(SessionStateEvent):
     state = FixedValueProperty('accepted')
     sdp = StringProperty(optional=True)  # missing for incoming sessions
     call_id = StringProperty(optional=True)
 
 
 class SessionEstablishedEvent(SessionStateEvent):
     state = FixedValueProperty('established')
 
 
 class SessionTerminatedEvent(SessionStateEvent):
     state = FixedValueProperty('terminated')
     reason = StringProperty(optional=True)
 
 
 # Video room events
 
 class VideoroomConfigureEvent(VideoroomEventBase):
     event = FixedValueProperty('configure')
     originator = StringProperty()
     active_participants = ArrayProperty(VideoroomActiveParticipants)  # type: VideoroomActiveParticipants
 
 
 class VideoroomSessionProgressEvent(VideoroomSessionStateEvent):
     state = FixedValueProperty('progress')
 
 
 class VideoroomSessionAcceptedEvent(VideoroomSessionStateEvent):
     state = FixedValueProperty('accepted')
     sdp = StringProperty()
     video = BooleanProperty(optional=True, default=True)
     audio = BooleanProperty(optional=True, default=True)
 
 
 class VideoroomSessionEstablishedEvent(VideoroomSessionStateEvent):
     state = FixedValueProperty('established')
 
 
 class VideoroomSessionTerminatedEvent(VideoroomSessionStateEvent):
     state = FixedValueProperty('terminated')
     reason = StringProperty(optional=True)
 
 
 class VideoroomFeedAttachedEvent(VideoroomEventBase):
     event = FixedValueProperty('feed-attached')
     feed = StringProperty()
     sdp = StringProperty()
 
 
 class VideoroomFeedEstablishedEvent(VideoroomEventBase):
     event = FixedValueProperty('feed-established')
     feed = StringProperty()
 
 
 class VideoroomInitialPublishersEvent(VideoroomEventBase):
     event = FixedValueProperty('initial-publishers')
     publishers = ArrayProperty(VideoroomPublishers)  # type: VideoroomPublishers
 
 
 class VideoroomPublishersJoinedEvent(VideoroomEventBase):
     event = FixedValueProperty('publishers-joined')
     publishers = ArrayProperty(VideoroomPublishers)  # type: VideoroomPublishers
 
 
 class VideoroomPublishersLeftEvent(VideoroomEventBase):
     event = FixedValueProperty('publishers-left')
     publishers = ArrayProperty(StringArray)          # type: StringArray
 
 
 class VideoroomFileSharingEvent(VideoroomEventBase):
     event = FixedValueProperty('file-sharing')
     files = ArrayProperty(SharedFiles)               # type: SharedFiles
 
 
 class VideoroomMessageEvent(VideoroomEventBase):
     event = FixedValueProperty('message')
     type = LimitedChoiceProperty(['normal', 'status'])
     content = StringProperty()
     content_type = StringProperty()
     sender = ObjectProperty(SIPIdentity)  # type: SIPIdentity
     timestamp = StringProperty()
 
 
 class VideoroomComposingIndicationEvent(VideoroomEventBase):
     event = FixedValueProperty('composing-indication')
     state = StringProperty()
     refresh = IntegerProperty()
     content_type = StringProperty()
     sender = ObjectProperty(SIPIdentity)  # type: SIPIdentity
 
 
 class VideoroomMessageDeliveryEvent(VideoroomEventBase):
     event = FixedValueProperty('message-delivery')
     message_id = StringProperty()
     delivered = BooleanProperty()
     code = IntegerProperty()
     reason = StringProperty()
 
 
 class VideoroomMuteAudioEvent(VideoroomEventBase):
     event = FixedValueProperty('mute-audio')
     originator = StringProperty()
 
 
 class VideoroomRaisedHandsEvent(VideoroomEventBase):
     event = FixedValueProperty('raised-hands')
     raised_hands = ArrayProperty(VideoroomRaisedHands)
 
 
 # Ping request model, can be used to check connectivity from client
 
 class PingRequest(SylkRTCRequestBase):
     sylkrtc = FixedValueProperty('ping')
 
 
 # Account request models
 
 class AccountAddRequest(AccountRequestBase):
     sylkrtc = FixedValueProperty('account-add')
     password = StringProperty(validator=LengthValidator(minimum=1, maximum=9999))
     display_name = StringProperty(optional=True)
     user_agent = StringProperty(optional=True)
 
 
 class AccountRemoveRequest(AccountRequestBase):
     sylkrtc = FixedValueProperty('account-remove')
 
 
 class AccountRegisterRequest(AccountRequestBase):
     sylkrtc = FixedValueProperty('account-register')
 
 
 class AccountUnregisterRequest(AccountRequestBase):
     sylkrtc = FixedValueProperty('account-unregister')
 
 
 class AccountDeviceTokenRequest(AccountRequestBase):
     sylkrtc = FixedValueProperty('account-devicetoken')
     token = StringProperty()
     platform = StringProperty()
     device = StringProperty()
     silent = BooleanProperty(default=False)
     app = StringProperty()
 
 
 class AccountMessageRequest(AccountRequestBase):
     sylkrtc = FixedValueProperty('account-message')
     uri = StringProperty(validator=AORValidator())
     message_id = StringProperty()
     content = StringProperty()
     content_type = StringProperty()
     timestamp = StringProperty()
 
 
 class AccountDispositionNotificationRequest(AccountRequestBase):
     sylkrtc = FixedValueProperty('account-disposition-notification')
     uri = StringProperty(validator=AORValidator())
     message_id = StringProperty()
     state = LimitedChoiceProperty(['delivered', 'failed', 'displayed', 'forbidden', 'error'])
     timestamp = StringProperty()
 
 
 class AccountSyncConversationsRequest(AccountRequestBase):
     sylkrtc = FixedValueProperty('account-sync-conversations')
     message_id = StringProperty(optional=True)
 
 
 class AccountMessageRemoveRequest(AccountRequestBase):
     sylkrtc = FixedValueProperty('account-remove-message')
     message_id = StringProperty()
     contact = StringProperty(validator=AORValidator())
 
 
 class AccountConversationRemoveRequest(AccountRequestBase):
     sylkrtc = FixedValueProperty('account-remove-conversation')
     contact = StringProperty(validator=AORValidator())
 
 
 # Session request models
 
 class SessionCreateRequest(SessionRequestBase):
     sylkrtc = FixedValueProperty('session-create')
     account = StringProperty(validator=AORValidator())
     uri = StringProperty(validator=AORValidator())
     sdp = StringProperty()
 
 
 class SessionAnswerRequest(SessionRequestBase):
     sylkrtc = FixedValueProperty('session-answer')
     sdp = StringProperty()
 
 
 class SessionTrickleRequest(SessionRequestBase):
     sylkrtc = FixedValueProperty('session-trickle')
     candidates = ArrayProperty(ICECandidates)  # type: ICECandidates
 
 
 class SessionTerminateRequest(SessionRequestBase):
     sylkrtc = FixedValueProperty('session-terminate')
 
 
 # Videoroom request models
 
 class VideoroomJoinRequest(VideoroomRequestBase):
     sylkrtc = FixedValueProperty('videoroom-join')
     account = StringProperty(validator=AORValidator())
     uri = StringProperty(validator=AORValidator())
     sdp = StringProperty()
     audio = BooleanProperty(optional=True, default=True)
     video = BooleanProperty(optional=True, default=True)
 
 
 class VideoroomLeaveRequest(VideoroomRequestBase):
     sylkrtc = FixedValueProperty('videoroom-leave')
 
 
 class VideoroomConfigureRequest(VideoroomRequestBase):
     sylkrtc = FixedValueProperty('videoroom-configure')
     active_participants = ArrayProperty(VideoroomActiveParticipants)  # type: VideoroomActiveParticipants
 
 
 class VideoroomFeedAttachRequest(VideoroomRequestBase):
     sylkrtc = FixedValueProperty('videoroom-feed-attach')
     publisher = StringProperty()
     feed = StringProperty()
 
 
 class VideoroomFeedAnswerRequest(VideoroomRequestBase):
     sylkrtc = FixedValueProperty('videoroom-feed-answer')
     feed = StringProperty()
     sdp = StringProperty()
 
 
 class VideoroomFeedDetachRequest(VideoroomRequestBase):
     sylkrtc = FixedValueProperty('videoroom-feed-detach')
     feed = StringProperty()
 
 
 class VideoroomInviteRequest(VideoroomRequestBase):
     sylkrtc = FixedValueProperty('videoroom-invite')
     participants = ArrayProperty(AORList)              # type: AORList
 
 
 class VideoroomSessionTrickleRequest(VideoroomRequestBase):
     sylkrtc = FixedValueProperty('videoroom-session-trickle')
     candidates = ArrayProperty(ICECandidates)          # type: ICECandidates
 
 
 class VideoroomSessionUpdateRequest(VideoroomRequestBase):
     sylkrtc = FixedValueProperty('videoroom-session-update')
     options = ObjectProperty(VideoroomSessionOptions)  # type: VideoroomSessionOptions
 
 
 class VideoroomMessageRequest(VideoroomRequestBase):
     sylkrtc = FixedValueProperty('videoroom-message')
     message_id = StringProperty()
     content = StringProperty()
     content_type = StringProperty()
 
 
 class VideoroomComposingIndicationRequest(VideoroomRequestBase):
     sylkrtc = FixedValueProperty('videoroom-composing-indication')
     state = LimitedChoiceProperty(['active', 'idle'])
     refresh = IntegerProperty(optional=True)
 
 
 class VideoroomMuteAudioParticipantsRequest(VideoroomRequestBase):
     sylkrtc = FixedValueProperty('videoroom-mute-audio-participants')
 
 
 class VideoroomToggleHandRequest(VideoroomRequestBase):
     sylkrtc = FixedValueProperty('videoroom-toggle-hand')
     session_id = StringProperty(optional=True)
 
 
 # SylkRTC request to model mapping
 
 class ProtocolError(Exception):
     pass
 
 
 class SylkRTCRequest(object):
     __classmap__ = {cls.sylkrtc.value: cls for cls in subclasses(SylkRTCRequestBase) if hasattr(cls, 'sylkrtc')}
 
     @classmethod
     def from_message(cls, message):
         try:
             request_type = message['sylkrtc']
         except KeyError:
             raise ProtocolError('could not get WebSocket message type')
         try:
             request_class = cls.__classmap__[request_type]
         except KeyError:
             raise ProtocolError('unknown WebSocket request: %s' % request_type)
         return request_class(**message)
diff --git a/sylk/applications/webrtcgateway/web.py b/sylk/applications/webrtcgateway/web.py
index ea3f8ba..d2f2327 100644
--- a/sylk/applications/webrtcgateway/web.py
+++ b/sylk/applications/webrtcgateway/web.py
@@ -1,197 +1,243 @@
 
 import json
 
 from application.python.types import Singleton
 from autobahn.twisted.resource import WebSocketResource
 from twisted.internet import defer, reactor
 from twisted.python.failure import Failure
 from twisted.web.server import Site
 from werkzeug.exceptions import Forbidden, NotFound
 from werkzeug.utils import secure_filename
 
 from sylk import __version__ as sylk_version
 from sylk.resources import Resources
 from sylk.web import File, Klein, StaticFileResource, server
 
 from . import push
 from .configuration import GeneralConfig, JanusConfig
 from .factory import SylkWebSocketServerFactory
 from .janus import JanusBackend
 from .logger import log
 from .models import sylkrtc
 from .protocol import SYLK_WS_PROTOCOL
-from .storage import TokenStorage
+from .storage import TokenStorage, MessageStorage
 
 
 __all__ = 'WebHandler', 'AdminWebHandler'
 
 
 class FileUploadRequest(object):
     def __init__(self, shared_file, content):
         self.deferred = defer.Deferred()
         self.shared_file = shared_file
         self.content = content
         self.had_error = False
 
 
+class ApiTokenAuthError(Exception): pass
+
+
 class WebRTCGatewayWeb(object, metaclass=Singleton):
     app = Klein()
 
     def __init__(self, ws_factory):
         self._resource = self.app.resource()
         self._ws_resource = WebSocketResource(ws_factory)
         self._ws_factory = ws_factory
 
     @property
     def resource(self):
         return self._resource
 
     @app.route('/', branch=True)
     def index(self, request):
         return StaticFileResource(Resources.get('html/webrtcgateway/'))
 
     @app.route('/ws')
     def ws(self, request):
         return self._ws_resource
 
     @app.route('/filesharing/<string:conference>/<string:session_id>/<string:filename>', methods=['OPTIONS', 'POST', 'GET'])
     def filesharing(self, request, conference, session_id, filename):
         conference_uri = conference.lower()
         if conference_uri in self._ws_factory.videorooms:
             videoroom = self._ws_factory.videorooms[conference_uri]
             if session_id in videoroom:
                 request.setHeader('Access-Control-Allow-Origin', '*')
                 request.setHeader('Access-Control-Allow-Headers', 'content-type')
                 method = request.method.upper().decode()
                 session = videoroom[session_id]
                 if method == 'POST':
                     def log_result(result):
                         if isinstance(result, Failure):
                             videoroom.log.warning('{file.uploader.uri} failed to upload {file.filename}: {error}'.format(file=upload_request.shared_file, error=result.value))
                         else:
                             videoroom.log.info('{file.uploader.uri} has uploaded {file.filename}'.format(file=upload_request.shared_file))
                         return result
 
                     filename = secure_filename(filename)
                     filesize = int(request.getHeader('Content-Length'))
                     shared_file = sylkrtc.SharedFile(filename=filename, filesize=filesize, uploader=dict(uri=session.account.id, display_name=session.account.display_name), session=session_id)
                     session.owner.log.info('wants to upload file {filename} to video room {conference_uri} with session {session_id}'.format(filename=filename, conference_uri=conference_uri, session_id=session_id))
                     upload_request = FileUploadRequest(shared_file, request.content)
                     videoroom.add_file(upload_request)
                     upload_request.deferred.addBoth(log_result)
                     return upload_request.deferred
                 elif method == 'GET':
                     filename = secure_filename(filename)
                     session.owner.log.info('wants to download file {filename} from video room {conference_uri} with session {session_id}'.format(filename=filename, conference_uri=conference_uri, session_id=session_id))
                     try:
                         path = videoroom.get_file(filename)
                     except LookupError as e:
                         videoroom.log.warning('{session.account.id} failed to download {filename}: {error}'.format(session=session, filename=filename, error=e))
                         raise NotFound()
                     else:
                         videoroom.log.info('{session.account.id} is downloading {filename}'.format(session=session, filename=filename))
                         request.setHeader('Content-Disposition', 'attachment;filename=%s' % filename)
                         return File(path)
                 else:
                     return 'OK'
         raise Forbidden()
 
+    def verify_api_token(self, request, account, msg_id, token=None):
+        if token:
+            auth_headers = request.requestHeaders.getRawHeaders('Authorization', default=None)
+            if auth_headers:
+                method, auth_token = auth_headers[0].split()
+            else:
+                log.warning(f'Authorization headers missing on message history request for {account}')
+
+            if not auth_headers or method != 'Apikey' or auth_token != token:
+                log.warning(f'Token authentication error for {account}')
+                raise ApiTokenAuthError()
+            else:
+                log.info(f'Returning message history for {account}')
+                return self.get_account_messages(request, account)
+
+    def tokenError(self, error, request):
+        raise ApiTokenAuthError()
+
+    def get_account_messages(self, request, account, msg_id=None):
+        account = account.lower()
+        storage = MessageStorage()
+        messages = storage[[account, msg_id]]
+        request.setHeader('Content-Type', 'application/json')
+        if isinstance(messages, defer.Deferred):
+            return messages.addCallback(lambda result:
+                                        json.dumps(sylkrtc.MessageHistoryData(account=account, messages=result).__data__))
+
+    @app.handle_errors(ApiTokenAuthError)
+    def auth_error(self, request, failure):
+        request.setResponseCode(401)
+        return b'Unauthorized'
+
+    @app.route('/messages/history/<string:account>', methods=['OPTIONS', 'GET'])
+    @app.route('/messages/history/<string:account>/<string:msg_id>', methods=['OPTIONS', 'GET'])
+    def messages(self, request, account, msg_id=None):
+        storage = MessageStorage()
+        token = storage.get_account_token(account)
+        if isinstance(token, defer.Deferred):
+            token.addCallback(lambda result: self.verify_api_token(request, account, msg_id, result))
+            return token
+        else:
+            return self.verify_api_token(request, account, msg_id, token)
+
 
 class WebHandler(object):
     def __init__(self):
         self.backend = None
         self.factory = None
         self.resource = None
         self.web = None
 
     def start(self):
         ws_url = 'ws' + server.url[4:] + '/webrtcgateway/ws'
         self.factory = SylkWebSocketServerFactory(ws_url, protocols=[SYLK_WS_PROTOCOL], server='SylkServer/%s' % sylk_version)
         self.factory.setProtocolOptions(allowedOrigins=GeneralConfig.web_origins,
                                         allowNullOrigin=GeneralConfig.web_origins == ['*'],
                                         autoPingInterval=GeneralConfig.websocket_ping_interval,
                                         autoPingTimeout=GeneralConfig.websocket_ping_interval/2)
 
         self.web = WebRTCGatewayWeb(self.factory)
         server.register_resource(b'webrtcgateway', self.web.resource)
 
         log.info('WebSocket handler started at %s' % ws_url)
         log.info('Allowed web origins: %s' % ', '.join(GeneralConfig.web_origins))
         log.info('Allowed SIP domains: %s' % ', '.join(GeneralConfig.sip_domains))
         log.info('Using Janus API: %s' % JanusConfig.api_url)
 
         self.backend = JanusBackend()
         self.backend.start()
 
     def stop(self):
         if self.factory is not None:
             for conn in self.factory.connections.copy():
                 conn.dropConnection(abort=True)
             self.factory = None
         if self.backend is not None:
             self.backend.stop()
             self.backend = None
 
 
 # TODO: This implementation is a prototype.  Moving forward it probably makes sense to provide admin API
 # capabilities for other applications too.  This could be done in a number of ways:
 #
 # * On the main web server, under a /admin/ parent route.
 # * On a separate web server, which could listen on a different IP and port.
 #
 # In either case, HTTPS aside, a token based authentication mechanism would be desired.
 # Which one is best is not 100% clear at this point.
 
 class AuthError(Exception): pass
 
 
 class AdminWebHandler(object, metaclass=Singleton):
     app = Klein()
 
     def __init__(self):
         self.listener = None
 
     def start(self):
         host, port = GeneralConfig.http_management_interface
         # noinspection PyUnresolvedReferences
         self.listener = reactor.listenTCP(port, Site(self.app.resource()), interface=host)
         log.info('Admin web handler started at http://%s:%d' % (host, port))
 
     def stop(self):
         if self.listener is not None:
             self.listener.stopListening()
             self.listener = None
 
     # Admin web API
 
     def _check_auth(self, request):
         auth_secret = GeneralConfig.http_management_auth_secret
         if auth_secret:
             auth_headers = request.requestHeaders.getRawHeaders('Authorization', default=None)
             if not auth_headers or auth_headers[0] != auth_secret:
                 raise AuthError()
 
     @app.handle_errors(AuthError)
     def auth_error(self, request, failure):
         request.setResponseCode(403)
         return 'Authentication error'
 
     @app.route('/tokens/<string:account>')
     def get_tokens(self, request, account):
         self._check_auth(request)
         request.setHeader('Content-Type', 'application/json')
         storage = TokenStorage()
         tokens = storage[account]
         if isinstance(tokens, defer.Deferred):
             return tokens.addCallback(lambda result: json.dumps({'tokens': result}))
         else:
             return json.dumps({'tokens': tokens})
 
     @app.route('/tokens/<string:account>/<string:device_token>', methods=['DELETE'])
     def process_token(self, request, account, device_token):
         self._check_auth(request)
         request.setHeader('Content-Type', 'application/json')
         storage = TokenStorage()
         if request.method == 'DELETE':
             storage.remove(account, device_token)
         return json.dumps({'success': True})