ice_servers and an expires_at timestamp. Each ICE server can contain URLs, a username, and a credential suitable for a browser RTCIceServer entry.
TURN credentials are intentionally short-lived. The realtime endpoint is organization-authenticated and protected by the shared rate-limiting layer.
Use the returned ICE servers directly in the browser client. Leamout handles the server-side media path behind the public WebRTC and SIP interfaces.