code>turn.example.com</code></strong></p><ul><li><p><span>If proxied (orange cloud), TURN fails (no UDP, TCP is intercepted).</span></p></li><li><p><span>Fix: set record to </span><strong><span>DNS only</span></strong><span>.</span></p></li></ul></li><li><p><strong><span>Mismatched secrets</span></strong></p><ul><li><p><span>If </span><code>serverinfo.turn.secret</code><span> ≠ </span><code>static-auth-secret</code><span>, allocation fails with </span><code>Cannot find credentials of user</code><span>.</s