Protect Your Stream Key on a VPS or Remote Machine

You moved OBS to a VPS so your stream keeps running when your own PC is off. The stream key moved with it. It now sits on a machine you reach over the internet, perhaps on a desktop that a co-host can open as well, and the key is all an encoder needs. Kick's help center says it in one line: "Anyone with your stream key can broadcast directly to your channel." This guide shows where the key lives on a remote machine, who can read it there, how to use that desktop without showing it, and how to reset it on Twitch, YouTube and Kick.

Quick answer: Treat the stream key as a password. OBS keeps it in plain text in service.json inside your profile folder (~/.config/obs-studio/basic/profiles/<profile>/ on Linux, %APPDATA%\obs-studio\basic\profiles\<profile>\ on Windows), with the previous version next to it in service.json.bak. Make that folder readable only by your user, keep VNC on localhost and the OBS WebSocket port closed and reach both through SSH, give helpers a Twitch guest key or YouTube channel permissions instead of your key or login, turn on two-factor authentication on every platform, and reset the key as soon as it shows up anywhere it shouldn't.

Why the Key Alone Is Enough

Twitch's stream key FAQ calls the key an "authorization key" that "essentially gives the encoder permission to stream to your Twitch account." YouTube's live stream settings page says stream keys "are like your YouTube stream's password and address." No password or two-factor code is involved: Twitch's broadcast guide gives the ingest address as rtmp://<ingest-server>/app/<stream-key>. Whoever has the key can point any encoder at the ingest server, and whatever they send goes out on your channel under your name.

Keys don't expire on their own. Twitch says you shouldn't need to re-enter your key "unless it is reset", and YouTube's encoder guide says your previous stream settings load for the next stream, "including your stream key". A key that leaked in a screenshot months ago still works today, unless it has been reset since.

Two things follow. A reset ends a leaked key but not a leaked login, because anyone signed in to your dashboard can read the new key. And on a remote machine the key is a file, so who can read files there matters as much as who sees your screen.

Where OBS Keeps the Key

OBS saves each profile's stream settings in service.json, as plain JSON with the key under settings.key. The folder depends on how OBS was installed:

On Linux, OBS uses $XDG_CONFIG_HOME instead of ~/.config when that variable is set, and Flatpak sets it to ~/.var/app/<app-id>/config. OBS's download page names the Flathub Flatpak and a PPA for Ubuntu 26.04 and newer as its official Linux builds, so on Ubuntu 24.04 and Debian 12 the official route is the Flatpak.

Three details make this folder more sensitive than it looks:

• Every save writes a new service.json and renames the old one to service.json.bak, so the previous key sits next to the current one.
• If you clicked Connect Account (recommended) for Twitch, basic.ini in the same folder has a [Twitch] section with Token and RefreshToken. OBS uses that login to fetch your key from Twitch's API, so basic.ini needs the same care.
• Profile > Export Profile copies basic.ini, service.json, streamEncoder.json and recordEncoder.json. An exported profile sent to a helper carries your key.

OBS doesn't restrict these files to your user: libobs creates its folders with mode 0755 and new files with 0666, both minus your umask. Check and lock them as the user that runs OBS:

ls -ld ~ ~/.config/obs-studio
ls -l ~/.config/obs-studio/basic/profiles/*/
chmod -R go-rwx ~/.config/obs-studio

For the Flatpak, put ~/.var/app/com.obsproject.Studio/config/obs-studio in place of ~/.config/obs-studio. Lock the folder rather than only service.json: OBS replaces the file on every save, and the new file gets default permissions again. Nothing hides the key from root or from anyone with sudo, so the people with admin rights on the machine are the people who can read your key.

Other Copies on the Same Machine

FFmpeg commands. If you stream with FFmpeg, the key is part of the RTMP URL on its command line. /proc/<pid>/cmdline "holds the complete command line for the process", and unless /proc is mounted with hidepid, everybody may read every process directory. ps reads those files, so any account on the machine can see your key. Check what is visible:

ps -eo user,args | grep -E 'rtmps?://'

If other people have shell accounts on that machine, move the stream or remove their accounts. Keep the key out of your shell history too: the .bashrc that Ubuntu and Debian give new users sets HISTCONTROL=ignoreboth, which skips commands that start with a space. Check yours with echo "$HISTCONTROL", especially as root. Our FFmpeg 24/7 guide shows how to keep the key in a file only you can read.

A relay on the same VPS. An nginx-rtmp relay keeps your platform keys in its push lines, and anyone who can publish to the relay goes live on your channels without ever seeing a key. Limit publishing to the machine itself and your own IP address; nginx-rtmp checks allow and deny in order:

application live {
    live on;
    allow publish 127.0.0.1;
    allow publish 203.0.113.25;
    deny publish all;
    push rtmp://ingest.example/app/YOUR_KEY;
}

Test and load it with sudo nginx -t && sudo nginx -s reload. Our relay guide adds a password check with on_publish for when your home IP address changes.

The OBS WebSocket server. Remote control apps connect to the WebSocket server you set up under Tools > WebSocket Server Settings. The server is off by default, uses port 4455 and requires a password by default, but any client with that password can call GetStreamServiceSettings and receive the key. Keep Enable Authentication on, keep port 4455 closed in your firewall, and reach it through an SSH tunnel like the desktop.

Use the Remote Desktop Without Showing the Key

Keep VNC on localhost. A VNC password is thin protection: tigervncpasswd only uses "the first eight characters", and the stored password "is not encrypted securely". On Ubuntu and Debian, tigervncserver listens on localhost only by default. Make that explicit and allow only one viewer at a time:

tigervncserver :1 -localhost yes -NeverShared
ss -ltn | grep 5901

The local address should be 127.0.0.1 or ::1, not 0.0.0.0, :: or *. Open the desktop through SSH with ssh -N -L 5901:localhost:5901 you@your-server-ip and point your VNC viewer at localhost:5901; our cloud OBS guide covers the desktop and VNC setup. With -NeverShared every connection counts as non-shared, and because DisconnectClients is on by default, a new viewer disconnects the current one. Nobody can watch alongside you, and an unexplained disconnect is worth checking. It also keeps your clipboard to yourself, since Xtigervnc sends clipboard changes to every connected viewer by default.

Leave the key hidden in OBS. The Stream Key field is masked, with a Show button next to it. Don't press it while someone watches, and never while a display or screen capture source sends the whole desktop to your stream; Twitch's FAQ tells you never to show the key on stream. Capture a window or a browser source instead of the full screen.

Sign out of the dashboards on the remote machine. If its browser stays signed in to Twitch, YouTube or Kick, anyone who opens that desktop can open the stream page and read the key. On a Space-Node streaming VPS, OBS comes preinstalled and you open the desktop in your browser, so keep that login as private as the key itself.

Give Helpers Access Without Your Key

Twitch puts it plainly: "we do not recommend sharing your stream key with anyone." If someone else must broadcast to your channel, add them under Permissions in your Stream settings, People who can stream to your channel. They get a guest key formatted live_sub_[streamkey], and removing their account is the only way to invalidate it; resetting your own key does not. On YouTube, channel permissions let people manage your channel "without needing access to your Google Account", and only the owner or a manager can reset a stream key.

Because the dashboard shows the key to whoever is signed in, turn on two-factor authentication everywhere you stream:

• Twitch: your Security and Privacy settings, Set Up Two-Factor Authentication. Enabling it logs you out on every other device.
• YouTube: your Google Account, Security & sign-in, then Turn on 2-Step Verification.
• Kick: kick.com/settings/security, then Enable 2FA.

Reset the Key on Each Platform

Then fix the remote machine:

1. Paste the new key in OBS under File > Settings > Stream and click Apply. Our Kick stream key guide shows the Kick setup.
2. Update every other copy: relay push lines, FFmpeg scripts and key files, multistream plugins and restream services.
3. Search for the old key to find copies you forgot, adding the folders that hold your scripts:

grep -rlsF 'OLD_KEY' ~/.config ~/.var/app
sudo grep -rlsF 'OLD_KEY' /etc

service.json.bak will still show up with the old key; that copy is harmless once the key is reset.

If It Still Fails

If someone still goes live on your channel after a reset, the leak isn't the old key.

1. Your account. Change the password (on Twitch that resets the key again), turn on two-factor authentication and check the email address on the account. Kick's recovery checklist adds payment information and connected accounts, and Kick's team can sign you out of all devices on request.
2. Guest keys and apps. On Twitch, remove authorized streamers you don't recognize. Apps you approved with the channel:read:stream_key scope can read your current key through Twitch's API for as long as they stay authorized, so disconnect the ones you no longer use.
3. The machine. If every new key leaks again, someone reads it on the server. A Space-Node VPS is self-managed with full root access, so who gets an account and sudo is up to you: check both, follow our SSH hardening guide, and if you find an account or SSH key you can't explain, back up your files, reinstall and reset the key once more.

FAQ

Can someone take over my channel with only the stream key? They can broadcast on it, which is enough to put their content under your name. The key only lets an encoder send video; opening your dashboard still takes your password, plus the second factor if you turned it on. That is why a reset ends a key leak but not an account takeover.

Will changing my Twitch password break my 24/7 stream? It changes your key, because Twitch resets the stream key each time you change your password. Paste the new key into OBS on the remote machine right after the change, since the encoder needs the current key to go live.

Is it safe to send my OBS profile to someone who helps with my settings? Not as it is. Export Profile copies service.json with the key, plus basic.ini with the Twitch login tokens if you used Connect Account. Send screenshots with the key hidden instead, and reset the key if you already shared a profile.

Does RTMPS protect my key? On the way to the platform, yes. YouTube describes RTMPS as RTMP over a TLS connection that "provides encryption", and the YouTube RTMPS entry built into OBS uses rtmps://a.rtmps.youtube.com:443/live2 as its primary server. It does nothing for a key that leaks from the machine, a screenshot or an exported profile.

Can a moderator use the remote desktop without seeing my key? Not reliably. OBS masks the key, but anyone who can use the desktop can press Show or open the profile folder. Keep moderators in the platform's own tools, and if someone else must stream to your channel, use a Twitch guest key or YouTube channel permissions.

Sources

All opened on 31 October 2026:

• OBS Studio source: OBSBasic_Service.cpp, OBSBasic_Profiles.cpp, OBSBasicSettings_Stream.cpp, OBSBasicSettings.ui, OAuth.cpp, TwitchAuth.cpp, OBSApp.cpp, platform.c, platform-nix.c, platform-windows.c, rtmp-common.c, rtmp-custom.c, services.json, en-US.ini, download page
• obs-websocket: protocol, Config.h, RequestHandler_Config.cpp, obs-websocket.cpp, en-US.ini
• Twitch: Stream Key FAQ, Two-Factor Authentication, Video Broadcast guide, Get Stream Key, scopes
• YouTube and Google: Manage live stream settings, Create a live stream with an encoder, RTMPS, channel permissions, 2-Step Verification
• Kick: OBS or Streamlabs not connecting, How to stream on KICK, account recovery, enable 2FA
• TigerVNC: tigervncpasswd(1), tigervncserver(1) on Ubuntu 24.04 and Debian 12, Xtigervnc(1)
• Linux: proc_pid_cmdline(5), proc(5), ps(1), bash(1), default .bashrc on Ubuntu 24.04 and Debian 12, chmod(1), ls(1), grep(1), fopen(3), ss(8), ssh(1)
• nginx: nginx-rtmp directives, command line
• Flatpak: conventions