MediaLive Nexus

Account Settings

Manage your account information and password

Profile Information

Username Username cannot be changed

Full Name

Role Contact an administrator to change your role

Change Password

Current Password

New Password Minimum 8 characters, must include uppercase, lowercase, and number

Confirm New Password

Preferences

Customize your user experience

Audio Meters

Meter Display Mode

LUFS (Loudness Units relative to Full Scale) dBFS (Decibels relative to Full Scale)

Changes audio level meter display units

Video Playback

Playback Mode WebRTC provides sub-second latency but requires MediaMTX. HLS has 6-15 second latency but is more reliable.

Display Settings

Default Tab on Login

Auto-refresh Interval (seconds)

Maximum Log Lines

Notifications

Show error notifications

Show success notifications

Show warning notifications

Application

Install and configure the app for your device

Install App

Installing as an app provides a standalone window that may work better with touchscreen monitors, and allows the app to run without browser chrome.

Touchscreen Mode

Enable larger touch targets Makes buttons and controls larger for easier touch interaction

Confirmation Dialogs

Control which actions require confirmation

Channel Operations

Confirm before switching channel inputs

Confirm before starting channels

Confirm before stopping channels

Graphics Operations

Confirm before activating graphics

Confirm before deleting graphics sets

User Management

Confirm before deleting users

Confirm before logging out

Views and Data

Confirm before deleting saved views

Confirm before clearing logs

Monitoring Settings

Configure system monitoring and polling intervals

Polling Configuration

Channel Polling Interval (ms) How often to poll channel status (1000-60000ms)

System Status Interval (ms) How often to check system status (5000-300000ms)

HDR Detection

Maximum Concurrent HDR Detections Number of simultaneous HDR detection processes (1-10)

Detailed Monitoring

Enable detailed server logging

Collect performance metrics

AWS Configuration

Configure AWS credentials and MediaLive settings

Note: AWS credentials are stored in environment variables and .env file. Restart required after changes.

AWS Credentials

AWS Region

AWS Access Key ID

Configured via environment variables (AWS_ACCESS_KEY_ID)

AWS Secret Access Key

Configured via environment variables (AWS_SECRET_ACCESS_KEY)

CloudFront Settings

Proxy CDN Domain (HLS Delivery) CloudFront distribution for HLS proxy stream delivery (serves S3 proxy bucket content)

Changes to AWS settings require server restart. Update .env file for persistence.

Proxy Stream Settings

Configure low-bandwidth proxy outputs for monitoring and backup

SRT → WebRTC (Low-Latency Preview)

Real-time monitoring with ~200ms latency. MediaLive pushes SRT to MediaMTX, which converts to WebRTC for browser playback. Best for live monitoring where latency matters.

Flow: MediaLive → SRT → MediaMTX → WebRTC → Browser
Requires MediaMTX running on the server. Add via channel menu → "Add WebRTC Proxy"

HLS Backup (CloudFront CDN)

Reliable fallback with ~10-15s latency. MediaLive writes HLS segments to S3, served via CloudFront. More stable but higher latency than WebRTC.

Flow: MediaLive → HLS → S3 → CloudFront → Browser
Add via channel menu → "Add HLS Proxy"

Proxy Encoder Settings

Video encoding settings for both SRT and HLS proxy outputs. Changes apply to new proxies only — existing outputs keep their original settings.

Width (px)

Height (px)

Bitrate (kbps) 100-10,000 kbps

Frame Rate

HLS Segment Length (seconds) Shorter = lower latency, longer = more stable

Maintenance

Regenerate Proxy Outputs — Delete and recreate proxy outputs on your selected channels with current settings. This will STOP affected channels during the process.

Clear HLS Bucket — Delete all HLS segments from S3 and invalidate CloudFront cache. Running channels will generate fresh streams.

SSO Configuration

Configure SAML 2.0 and OpenID Connect identity providers

Identity Providers

How SSO Works

When an SSO provider is enabled, a "Login with SSO" button appears on the login page
Users are redirected to the identity provider to authenticate
New users are auto-provisioned with the mapped role (or default role)
SSO users cannot use password-based login
For SAML: download the SP metadata from the provider detail view to configure your IdP
For OIDC: use the callback URL shown in the provider detail view

Connecting Okta via OIDC

Step-by-step guide to connect Okta as an OpenID Connect identity provider.

▶ Step 1: Create an App Integration in Okta

Log in to your Okta Admin Console
Navigate to Applications → Applications → Create App Integration
Select OIDC - OpenID Connect as the sign-in method
Select Web Application as the application type
Click Next

▶ Step 2: Configure the App Integration

App integration name	`MediaLive Nexus` (or any name)
Grant type	Authorization Code (default, leave checked)
Sign-in redirect URI	`https://<your-domain>/auth/sso/oidc/callback`
Sign-out redirect URI	Leave empty
Controlled access	Select which users/groups should have access

Click Save to create the application.

▶ Step 3: Collect the Credentials

From the app's General tab, copy the following values:

Client ID — e.g. 0oaxxxxxxxxxxxxxxxxxx
Client Secret — click the eye icon to reveal, then copy

Issuer URL:

Go to Security → API → Authorization Servers
Copy the Issuer URI for your authorization server
Default server: https://dev-12345678.okta.com/oauth2/default
Org server: https://your-org.okta.com

▶ Step 4: Configure Group Claims (for role mapping)

To map Okta groups to MediaLive Nexus roles, you need to include a groups claim in the token:

Option A — Via App Settings:

In the Okta app, go to Sign On → OpenID Connect ID Token
Under Groups claim type, select Filter
Claim name: groups, Filter: Matches regex .*

Option B — Via Authorization Server:

Go to Security → API → Authorization Servers → default → Claims
Click Add Claim
Name: groups, Include in: ID Token + Access Token (Always)
Value type: Groups, Filter: Matches regex .*

▶ Step 5: Add the Provider in MediaLive Nexus

Click "+ Add Provider" at the top of this page
Set Display Name to Okta (or your organization name)
Set Protocol to OpenID Connect (OIDC)
Paste the Issuer URL, Client ID, and Client Secret from Step 3
Set Scopes to openid profile email groups
Choose a Default Role for users without a group mapping match
Optionally add Group → Role Mappings (e.g. Okta group mlx-admins → Admin)
Check Enable this provider
Click Save

▶ Step 6: Test the Connection

Click the Test button on the provider card above
If successful, the OIDC discovery document was fetched from your Okta issuer
Open the login page — a "Login with Okta" button should appear
Click it to verify the full authentication flow

▶ Troubleshooting

invalid_client	Double-check the Client ID and Client Secret. Regenerate the secret in Okta if needed.
redirect_uri_mismatch	The Sign-in redirect URI in Okta must match exactly: `https://<your-domain>/auth/sso/oidc/callback`. Check for trailing slashes or http vs https.
No groups in token	Verify the `groups` claim is configured in Okta (Step 4) and the `groups` scope is included.
SSO button missing	Make sure the provider is enabled (checkbox in the form).
BASE_URL mismatch	The server's `BASE_URL` environment variable must match your domain exactly (e.g. `https://fsd.livenex.us`). The callback URL is derived from this value.

Server Configuration

Configure server-wide settings and security

Warning: Changes to server configuration may require restart and can affect all users.

Authentication & Security

JWT Token Expiration (seconds) Access token lifetime (300-86400 seconds / 5min-24hr)

Refresh Token Expiration (seconds) Refresh token lifetime (1-30 days)

Max Login Attempts Number of failed attempts before lockout

Server Settings

Server Port Requires server restart

Log Level

Session Management

Automatically clean up expired sessions

Session Cleanup Interval (hours) How often to clean expired sessions (1-168 hours)

Server configuration is stored in .env file. Changes require server restart to take effect.

Server Management

Restart the server to apply configuration changes. The page will automatically refresh when the server is back online.

AWS Services

View AWS resources and connection status for troubleshooting

AWS Connection

☁️ AWS Region

🔗 Connection Status

🌐 Proxy CDN (CloudFront)

📦 S3 Proxy Bucket

MediaLive Channels

Total: -- Running: -- Idle: --

Channel Name	Channel ID	State	Inputs
Loading...

MediaLive Inputs

Total Inputs: --

Input Name	Input ID	Type	State
Loading...

SRT Transcode Monitoring

Real-time monitoring of SRT ingest and WebRTC output streams via MediaMTX

Service Status

📡 MediaMTX

📊 Total Bandwidth

🔗 Active Streams

Active Transcode Streams

Each stream shows the SRT ingest and WebRTC output status. Data refreshes every 5 seconds.

Loading stream data...

Database Backups

Manage database backups with automatic daily scheduling and manual triggers

Create Backup

Create a manual backup of both databases. Includes user accounts, settings, Kinetica templates, library metadata, reference data, and all saved configurations.

Available Backups

Last 7 backups are retained. Daily automatic backups run at 3:00 AM. Each backup includes both Auth and Kinetica databases.

Filename	Size	Created	Actions
Loading...

AI Assistant

Configure the Claude AI integration for the Kinetica template builder

Claude API Key

Enter your Anthropic API key to enable the AI assistant in the builder. The key is stored server-side and never sent to the browser.

Model

Select which Claude model to use. Sonnet is recommended for most tasks — fast and precise. Opus is slower but more capable for complex template generation. Haiku is fastest and cheapest for simple edits.

System Administration

Git operations and environment configuration

Warning: These operations can affect system stability. Use with caution.

Git Operations

Current Commit: --

Branch: --

Last Message: --

Commit Date: --

Note: After pulling updates, you must restart the server for changes to take effect.

Environment Configuration

Edit server environment variables. Changes require a server restart.

Security Notice: Sensitive values (JWT_SECRET, AWS credentials) are hidden and cannot be modified through this interface.

Loading configuration...

Server Control

Restart the server to apply configuration and code changes.

Server Logs

View real-time server logs and events

Auto-scroll

⏳ Waiting for server logs...

Changelog

Version history and release notes

📄 Loading changelog...

Multiview Creator

Available Channels

Box Configuration

Channel Flow Editor

Available Inputs

Saved Outputs

Output Templates

New Output

New Output Template

Apply Template:

Graphics Management

Graphics Sets

Select a set

FAST Scheduler

Preview

New Event

Video Packages

Scheduler Configuration

Browse S3 Content

Video Package Manager

Packages

Account Settings

Profile Information

Change Password

Preferences

Audio Meters

Video Playback

Display Settings

Notifications

Application

Install App

Touchscreen Mode

Confirmation Dialogs

Channel Operations

Graphics Operations

User Management

Views and Data

Monitoring Settings

Polling Configuration

HDR Detection

Detailed Monitoring

AWS Configuration

AWS Credentials

CloudFront Settings

Proxy Stream Settings

SRT → WebRTC (Low-Latency Preview)

HLS Backup (CloudFront CDN)

Proxy Encoder Settings

Maintenance

SSO Configuration

Identity Providers

How SSO Works

Connecting Okta via OIDC

Add SSO Provider

Server Configuration

Authentication & Security

Server Settings

Session Management

Server Management

AWS Services

AWS Connection

MediaLive Channels

MediaLive Inputs

SRT Transcode Monitoring

Service Status

Active Transcode Streams

Database Backups

Create Backup

Available Backups

AI Assistant

Claude API Key

Model

System Administration

Git Operations

Environment Configuration

Server Control

Server Logs

Changelog

User Management

Roles