The most common trap: joinMeeting() executes the join server-side, so the user's browser never receives the session cookie the BBB server sets on join. The standard flow is to redirect the user's browser to a generated join URL:
$joinUrl = $bbb->getJoinMeetingURL($joinMeetingParameters);
header('Location: ' . $joinUrl);Use joinMeeting() (with setRedirect(false)) only when you explicitly need the join response — e.g. session tokens for API-driven clients. See also the Joining chapter.
Only if you join meetings server-side (see above) or drive clients that cannot hold a session. It weakens the meeting's security — prefer the redirect flow.
The library tracks the current BigBlueButton API across BBB 2.x, 3.x and 4.x: parameters removed on newer servers remain available (marked deprecated) so integrations against older servers keep working, and new server parameters are added as soon as they are documented.
The /api/feedback endpoint is reserved in the BBB server source but not routed on current releases. The library ships the implementation marked experimental; it will start working once a BBB release actually provides the endpoint.
bbb-conf --secret on the server — see Server Configuration.
Yes — any PSR-18 client with PSR-17 factories can be injected, see HTTP Client. curl stays the dependency-free default.
It captures only the JSESSIONID the server sets on some calls, validates it, and exposes it via getJSessionId(). No cookies are persisted or sent back — details in Cookies and the JSESSIONID.
On GitHub — with a reproducing code sample against the current release if possible.