Migrating from Self-Hosted coturn to ExpressTURN

Why teams migrate

The coturn install was fine for a while. Then something happened: the VPS bill jumped, a TLS cert expired during a holiday, the single-region relay added latency for international users, or simply: nobody on the team wants to own infra anymore. ExpressTURN is the cheap exit.

If you're not sure whether to migrate, read the honest comparison first. This guide assumes you've decided.

Step 1 — Sign up and grab credentials

Sign up at expressturn.com/signup. Copy turn_username and turn_password from the dashboard. The free tier covers 1 TB/month; upgrade to premium ($9/month for 5 TB) when you outgrow it.

Step 2 — Add ExpressTURN alongside coturn

List both in your client's iceServers. ICE will pick whichever path connects first. Run this dual config for a week to confirm ExpressTURN is healthy in your real traffic.

iceServers: [
  { urls: 'stun:stun.expressturn.com:3478' },
  { urls: ['turn:relay1.expressturn.com:3478?transport=udp',
           'turn:relay1.expressturn.com:3478?transport=tcp',
           'turns:relay1.expressturn.com:443?transport=tcp'],
    username: 'YOUR_EXPRESSTURN_USERNAME',
    credential: 'YOUR_EXPRESSTURN_PASSWORD' },
  // existing coturn — keep during transition
  { urls: ['turn:turn.your-domain.com:3478?transport=udp'],
    username: 'EXISTING_USER',
    credential: 'EXISTING_CRED' }
]

Step 3 — Validate via webrtc-internals

In Chrome, open chrome://webrtc-internals during real calls. Look at the Selected Candidate Pair. You should see a mix of relays from both relay1.expressturn.com and your old coturn host. Confirm both work; check the candidate-failure stats for either provider.

Step 4 — Force-relay on a canary

On a small percentage of users, push iceTransportPolicy: 'relay' to force every connection through TURN. Watch your error rates. If ExpressTURN is healthy, every relayed call succeeds.

Step 5 — Drop coturn from the iceServers list

Remove the old entry from your client config. Deploy. Watch for issues for ~24 hours.

Step 6 — Decommission the coturn VPS

Stop the coturn service, then take a final backup of the config in case you ever want to roll back. Cancel the VPS at the end of its billing cycle. Email yourself the savings.

Migrating shared-secret authentication

If your coturn used use-auth-secret with HMAC-signed credentials, ExpressTURN premium supports the same RFC pattern. Move your secret-key generator to use ExpressTURN's premium secret instead. See examples in 4 languages.

What can break during the cutover

• Hard-coded host candidates somewhere unexpected: Some legacy clients embed candidate URLs in custom config files outside the main iceServers array. Search the codebase for your old coturn hostname.
• Stale DNS cache: If you keep turn.your-domain.com as a CNAME during transition, watch TTLs.
• Network policy referencing coturn IP: Internal firewalls allow-listing your old coturn's IP need updating to allow relay1.expressturn.com instead.

Related: vs self-hosted coturn — honest comparison