Overview
Private Links let a deployed LiveKit Cloud agent connect to a service running inside your own cloud network, such as a database, cache, or internal API, without exposing that service to the public internet. The connection runs over your cloud provider's native private connectivity: AWS PrivateLink or Azure Private Link .
You keep control of access on your side: LiveKit connects through a cloud principal (an identity) you explicitly authorize, and you approve the connection from your own AWS or Azure account, where you can also revoke it later. Once the link is healthy, your agent reaches the service through a generated *.link hostname that resolves only from within the agent runtime.
Use Private Links when your agent needs a private service that can't be reached over the public internet, such as one of the following:
- A managed database or cache (for example, Amazon RDS, Azure Managed Redis) with no public endpoint.
- An internal API or microservice that lives inside your VPC.
- A service subject to data-residency or compliance requirements that prohibit public exposure.
For Private Links pricing information, see the Pricing page .
How it works
You expose the target service behind an endpoint service in your cloud account, authorize LiveKit to connect, and create a link in LiveKit that points at that endpoint. After you approve the connection request, LiveKit provisions its side and your agent connects through the private link.
When you create a link, LiveKit provisions a gateway in a LiveKit-managed VPC in the same cloud region as your resource. Your agent connects to a generated *.link hostname that resolves only from within the agent runtime. That traffic travels through an encrypted WireGuard tunnel to the gateway, enters your network over AWS PrivateLink or Azure Private Link, and reaches your service through your load balancer. Your resource is never exposed to the public internet, and you approve the connection only once.
The following diagram is illustrative and describes the Private Links path for AWS:
Supported providers and regions
Private Links support two cloud providers: AWS, over AWS PrivateLink, and Azure, over Azure Private Link in the following regions:
| Region | AWS region |
|---|---|
| US East | us-east-1 |
| US West | us-west-1 |
| EU Central | eu-central-1 |
| Region | Azure region |
|---|---|
| East US | eastus |
| West US | westus |
| Belgium Central | belgiumcentral |
| UK South | uksouth |
Private Links are available for agents deployed to the following regions:
| Region code | Geographic location |
|---|---|
us-east | Ashburn, Virginia, USA |
eu-central | Frankfurt, Germany |
If your region isn't listed, contact LiveKit support to request availability.
Set up a private link
Set up a private link using the following steps:
- Expose your target service behind an endpoint service.
- Authorize LiveKit's cloud principal to connect to it.
- Create the link in LiveKit, specifying the LiveKit agent region and the target port.
- Approve the pending connection request through your endpoint service provider.
- Wait for the link to report a
HEALTHYstatus, then connect from your agent using the generated*.linkhostname.
Setup varies by cloud provider. Use the following guides to set up a private link for your provider:
Set up on AWS
Connect through AWS PrivateLink using a Network Load Balancer endpoint service.
Set up on Azure
Connect through Azure Private Link using a Private Link Service.
Limitations
- Connections must be TCP secured with TLS, and must negotiate TLS before sending any data. Protocols that begin with a standard TLS handshake, such as PostgreSQL, work without changes. Insecure TCP and general UDP traffic aren't supported.
- Your agent must run in the same LiveKit region as the private link.
- The
*.linkhostname resolves only from within a deployed agent, not from your local machine. - Each link exposes a single TCP port. Create a separate link for each port you need to reach.
- Your agent opens the connection to your service and can both send and receive data over it (for example, query a database and read the result). Your service can't open a connection back to your agent.
- The connection requires manual approval on your side before it becomes active.
- Private Links are immutable. You can't edit a link after you create it. To change one, create a replacement link and delete the old one.
- Each project supports up to 3 private links per agent deployment region. To request more for a project, contact LiveKit support .
Additional resources
The following additional resources are available to help you monitor and manage Private Links.