diff --git a/.dockerignore b/.dockerignore
index 5e31ad1f..3f876a0f 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -6,3 +6,7 @@
 /internal/core/VERSION
 /internal/servers/hls/hls.min.js
 /internal/staticsources/rpicamera/mtxrpicam_*/
+/auto.crt
+/auto.key
+/internal/core/auto.crt
+/internal/core/auto.key
diff --git a/.gitignore b/.gitignore
index e2a09ccf..05859fd5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,7 @@
 /internal/core/VERSION
 /internal/servers/hls/hls.min.js
 /internal/staticsources/rpicamera/mtxrpicam_*/
+/auto.crt
+/auto.key
+/internal/core/auto.crt
+/internal/core/auto.key
diff --git a/README.md b/README.md
index 6f3f79aa..3e1c9410 100644
--- a/README.md
+++ b/README.md
@@ -28,8 +28,8 @@ _MediaMTX_ is a ready-to-use and zero-dependency real-time media server and medi
 
 <h3>Features</h3>
 
-- [Publish](https://mediamtx.org/docs/features/publish) live streams to the server with SRT, WebRTC, RTSP, RTMP, HLS, MPEG-TS, RTP, using FFmpeg, GStreamer, OBS Studio, Python , Golang, Unity, web browsers, Raspberry Pi Cameras and more.
-- [Read](https://mediamtx.org/docs/features/read) live streams from the server with SRT, WebRTC, RTSP, RTMP, HLS, using FFmpeg, GStreamer, VLC, OBS Studio, Python , Golang, Unity, web browsers and more.
+- [Publish](https://mediamtx.org/docs/features/publish) live streams to the server with Media-over-QUIC, SRT, WebRTC, RTSP, RTMP, HLS, MPEG-TS, RTP, using FFmpeg, GStreamer, OBS Studio, Python , Golang, Unity, web browsers, Raspberry Pi Cameras and more.
+- [Read](https://mediamtx.org/docs/features/read) live streams from the server with Media-over-QUIC, SRT, WebRTC, RTSP, RTMP, HLS, using FFmpeg, GStreamer, VLC, OBS Studio, Python , Golang, Unity, web browsers and more.
 - Streams are automatically converted from a protocol to another
 - Serve several streams at once in separate paths
 - Reload the configuration without disconnecting existing clients (hot reloading)
diff --git a/api/openapi.yaml b/api/openapi.yaml
index 513cdd7f..029b3c75 100644
--- a/api/openapi.yaml
+++ b/api/openapi.yaml
@@ -155,6 +155,10 @@ components:
       type: string
       enum: [read, publish]
 
+    MoQSessionState:
+      type: string
+      enum: [idle, read, publish]
+
     OK:
       type: object
       properties:
@@ -594,6 +598,26 @@ components:
         srtAddress:
           type: string
 
+        # MoQ server
+        moq:
+          type: boolean
+        moqHTTPS2Address:
+          type: string
+        moqHTTPS3Address:
+          type: string
+        moqServerKey:
+          type: string
+        moqServerCert:
+          type: string
+        moqAllowOrigins:
+          type: array
+          items:
+            type: string
+        moqTrustedProxies:
+          type: array
+          items:
+            type: string
+
         # Record (deprecated)
         record:
           type: boolean
@@ -1856,6 +1880,39 @@ components:
           items:
             $ref: "#/components/schemas/WebRTCSession"
 
+    MoQSession:
+      type: object
+      properties:
+        id:
+          type: string
+          format: uuid
+        created:
+          type: string
+        remoteAddr:
+          type: string
+        state:
+          $ref: "#/components/schemas/MoQSessionState"
+        path:
+          type: string
+        query:
+          type: string
+        userAgent:
+          type: string
+
+    MoQSessionList:
+      type: object
+      properties:
+        pageCount:
+          type: integer
+          format: int64
+        itemCount:
+          type: integer
+          format: int64
+        items:
+          type: array
+          items:
+            $ref: "#/components/schemas/MoQSession"
+
 paths:
   /v3/info:
     get:
@@ -3388,6 +3445,123 @@ paths:
               schema:
                 $ref: "#/components/schemas/Error"
 
+  /v3/moqsessions/list:
+    get:
+      operationId: moqSessionsList
+      tags: [MoQ]
+      summary: returns all MoQ sessions.
+      description: ""
+      parameters:
+        - name: page
+          in: query
+          description: page number.
+          schema:
+            type: integer
+            default: 0
+        - name: itemsPerPage
+          in: query
+          description: items per page.
+          schema:
+            type: integer
+            default: 100
+      responses:
+        "200":
+          description: the request was successful.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/MoQSessionList"
+        "400":
+          description: invalid request.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+        "500":
+          description: server error.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+
+  /v3/moqsessions/get/{id}:
+    get:
+      operationId: moqSessionsGet
+      tags: [MoQ]
+      summary: returns a MoQ session.
+      description: ""
+      parameters:
+        - name: id
+          in: path
+          required: true
+          description: ID of the session.
+          schema:
+            type: string
+      responses:
+        "200":
+          description: the request was successful.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/MoQSession"
+        "400":
+          description: invalid request.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+        "404":
+          description: session not found.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+        "500":
+          description: server error.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+
+  /v3/moqsessions/kick/{id}:
+    post:
+      operationId: moqSessionsKick
+      tags: [MoQ]
+      summary: kicks out a MoQ session from the server.
+      description: ""
+      parameters:
+        - name: id
+          in: path
+          required: true
+          description: ID of the session.
+          schema:
+            type: string
+      responses:
+        "200":
+          description: the request was successful.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OK"
+        "400":
+          description: invalid request.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+        "404":
+          description: session not found.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+        "500":
+          description: server error.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+
   /v3/recordings/list:
     get:
       operationId: recordingsList
diff --git a/docs/1-kickoff/1-introduction.md b/docs/1-kickoff/1-introduction.md
index cd276db5..f31261f8 100644
--- a/docs/1-kickoff/1-introduction.md
+++ b/docs/1-kickoff/1-introduction.md
@@ -6,8 +6,8 @@ _MediaMTX_ is a ready-to-use and zero-dependency live media server and media pro
 
 Main features:
 
-- [Publish](../2-features/03-publish.md) live streams to the server with SRT, WebRTC, RTSP, RTMP, HLS, MPEG-TS, RTP, using FFmpeg, GStreamer, OBS Studio, Python , Golang, Unity, Web browsers, Raspberry Pi Cameras and more.
-- [Read](../2-features/04-read.md) live streams from the server with SRT, WebRTC, RTSP, RTMP, HLS, using FFmpeg, GStreamer, VLC, OBS Studio, Python , Golang, Unity, Web browsers and more.
+- [Publish](../2-features/03-publish.md) live streams to the server with Media-over-QUIC, SRT, WebRTC, RTSP, RTMP, HLS, MPEG-TS, RTP, using FFmpeg, GStreamer, OBS Studio, Python , Golang, Unity, Web browsers, Raspberry Pi Cameras and more.
+- [Read](../2-features/04-read.md) live streams from the server with Media-over-QUIC, SRT, WebRTC, RTSP, RTMP, HLS, using FFmpeg, GStreamer, VLC, OBS Studio, Python , Golang, Unity, Web browsers and more.
 - Streams are automatically converted from a protocol to another
 - Serve several streams at once in separate paths
 - Reload the configuration without disconnecting existing clients (hot reloading)
diff --git a/docs/2-features/03-publish.md b/docs/2-features/03-publish.md
index deedac41..4ff73f13 100644
--- a/docs/2-features/03-publish.md
+++ b/docs/2-features/03-publish.md
@@ -2,29 +2,30 @@
 
 Live streams can be published to the server with the following protocols:
 
-- [SRT clients](../3-publish/01-srt-clients.md)
-- [SRT cameras and servers](../3-publish/02-srt-cameras-and-servers.md)
-- [WebRTC clients](../3-publish/03-webrtc-clients.md)
-- [WebRTC servers](../3-publish/04-webrtc-servers.md)
-- [RTSP clients](../3-publish/05-rtsp-clients.md)
-- [RTSP cameras and servers](../3-publish/06-rtsp-cameras-and-servers.md)
-- [RTMP clients](../3-publish/07-rtmp-clients.md)
-- [RTMP cameras and servers](../3-publish/08-rtmp-cameras-and-servers.md)
-- [HLS cameras and servers](../3-publish/09-hls-cameras-and-servers.md)
-- [MPEG-TS](../3-publish/10-mpeg-ts.md)
-- [RTP](../3-publish/11-rtp.md)
+- [Media-over-QUIC clients](../3-publish/01-moq-clients.md)
+- [SRT clients](../3-publish/02-srt-clients.md)
+- [SRT cameras and servers](../3-publish/04-srt-cameras-and-servers.md)
+- [WebRTC clients](../3-publish/05-webrtc-clients.md)
+- [WebRTC servers](../3-publish/06-webrtc-servers.md)
+- [RTSP clients](../3-publish/07-rtsp-clients.md)
+- [RTSP cameras and servers](../3-publish/08-rtsp-cameras-and-servers.md)
+- [RTMP clients](../3-publish/09-rtmp-clients.md)
+- [RTMP cameras and servers](../3-publish/10-rtmp-cameras-and-servers.md)
+- [HLS cameras and servers](../3-publish/11-hls-cameras-and-servers.md)
+- [MPEG-TS](../3-publish/12-mpeg-ts.md)
+- [RTP](../3-publish/13-rtp.md)
 
 We provide instructions for publishing with the following devices:
 
-- [Raspberry Pi Cameras](../3-publish/12-raspberry-pi-cameras.md)
-- [Generic webcams](../3-publish/13-generic-webcams.md)
+- [Raspberry Pi Cameras](../3-publish/14-raspberry-pi-cameras.md)
+- [Generic webcams](../3-publish/15-generic-webcams.md)
 
 We provide instructions for publishing with the following software:
 
-- [Web browsers](../3-publish/14-web-browsers.md)
-- [FFmpeg](../3-publish/15-ffmpeg.md)
-- [GStreamer](../3-publish/16-gstreamer.md)
-- [OBS Studio](../3-publish/17-obs-studio.md)
-- [Python and OpenCV](../3-publish/18-python-opencv.md)
-- [Golang](../3-publish/19-golang.md)
-- [Unity](../3-publish/20-unity.md)
+- [Web browsers](../3-publish/16-web-browsers.md)
+- [FFmpeg](../3-publish/17-ffmpeg.md)
+- [GStreamer](../3-publish/18-gstreamer.md)
+- [OBS Studio](../3-publish/19-obs-studio.md)
+- [Python and OpenCV](../3-publish/20-python-opencv.md)
+- [Golang](../3-publish/21-golang.md)
+- [Unity](../3-publish/22-unity.md)
diff --git a/docs/2-features/04-read.md b/docs/2-features/04-read.md
index 2d799bf2..7f729289 100644
--- a/docs/2-features/04-read.md
+++ b/docs/2-features/04-read.md
@@ -2,19 +2,20 @@
 
 Live streams can be read from the server with the following protocols:
 
-- [SRT clients](../4-read/01-srt.md)
-- [WebRTC clients](../4-read/02-webrtc.md)
-- [RTSP clients](../4-read/03-rtsp.md)
-- [RTMP clients](../4-read/04-rtmp.md)
-- [HLS](../4-read/05-hls.md)
+- [Media-over-QUIC clients](../4-read/01-moq.md)
+- [SRT clients](../4-read/02-srt.md)
+- [WebRTC clients](../4-read/03-webrtc.md)
+- [RTSP clients](../4-read/04-rtsp.md)
+- [RTMP clients](../4-read/05-rtmp.md)
+- [HLS](../4-read/06-hls.md)
 
 We provide instructions for reading with the following software:
 
-- [Web browsers](../4-read/06-web-browsers.md)
-- [FFmpeg](../4-read/07-ffmpeg.md)
-- [GStreamer](../4-read/08-gstreamer.md)
-- [VLC](../4-read/09-vlc.md)
-- [OBS Studio](../4-read/10-obs-studio.md)
-- [Python and OpenCV](../4-read/11-python-opencv.md)
-- [Golang](../4-read/12-golang.md)
-- [Unity](../4-read/13-unity.md)
+- [Web browsers](../4-read/07-web-browsers.md)
+- [FFmpeg](../4-read/08-ffmpeg.md)
+- [GStreamer](../4-read/09-gstreamer.md)
+- [VLC](../4-read/10-vlc.md)
+- [OBS Studio](../4-read/11-obs-studio.md)
+- [Python and OpenCV](../4-read/12-python-opencv.md)
+- [Golang](../4-read/13-golang.md)
+- [Unity](../4-read/14-unity.md)
diff --git a/docs/2-features/06-authentication.md b/docs/2-features/06-authentication.md
index 05ff2bb3..dada730c 100644
--- a/docs/2-features/06-authentication.md
+++ b/docs/2-features/06-authentication.md
@@ -299,7 +299,7 @@ Username and password can be passed through the `Authorization: Basic` HTTP head
 Authorization: Basic base64(myuser:mypass)
 ```
 
-When using a web browser, a dialog is first shown to users, asking for credentials, and then the header is automatically inserted into every request. If you need to automatically fill credentials from a parent web page, read [Embed in a website](../4-read/06-web-browsers.md#embed-in-a-website).
+When using a web browser, a dialog is first shown to users, asking for credentials, and then the header is automatically inserted into every request. If you need to automatically fill credentials from a parent web page, read [Embed in a website](../4-read/07-web-browsers.md#embed-in-a-website).
 
 If the `Authorization: Basic` header cannot be used (for instance, in software like OBS Studio, which only allows to provide a "Bearer Token"), credentials can be passed through the `Authorization: Bearer` header (i.e. the "Bearer Token" in OBS), where the value is the concatenation of username and password, separated by a colon:
 
@@ -351,4 +351,4 @@ In OBS Studio, this is the "Bearer Token" field.
 
 If the `Authorization: Bearer` token cannot be directly provided (for instance, with web browsers that directly access _MediaMTX_ and show a credential dialog), you can pass the token as password, using an arbitrary user.
 
-In web browsers, if you need to automatically fill credentials from a parent web page, read [Embed in a website](../4-read/06-web-browsers.md#embed-in-a-website).
+In web browsers, if you need to automatically fill credentials from a parent web page, read [Embed in a website](../4-read/07-web-browsers.md#embed-in-a-website).
diff --git a/docs/2-features/16-expose-the-server-in-a-subfolder.md b/docs/2-features/16-expose-the-server-in-a-subfolder.md
index 06ceb8d1..b4221f53 100644
--- a/docs/2-features/16-expose-the-server-in-a-subfolder.md
+++ b/docs/2-features/16-expose-the-server-in-a-subfolder.md
@@ -1,12 +1,14 @@
 # Expose the server in a subfolder
 
-HTTP-based services (WebRTC, HLS, Control API, Playback Server, Metrics, pprof) can be exposed in a subfolder of an existing HTTP server or reverse proxy. The reverse proxy must be able to intercept HTTP requests addressed to _MediaMTX_ and corresponding responses, and perform the following changes:
+HTTP-based services (Media-over-QUIC, WebRTC, HLS, Control API, Playback Server, Metrics, pprof) can be exposed in a subfolder of an external HTTP server or reverse proxy. The reverse proxy must be able to intercept HTTP requests addressed to _MediaMTX_ and corresponding responses, and must perform the following changes:
 
 - The subfolder path must be stripped from request paths. For instance, if the server is exposed behind `/subpath` and the reverse proxy receives a request with path `/subpath/mystream/index.m3u8`, this has to be changed into `/mystream/index.m3u8`.
 
 - Any `Location` header in responses must be prefixed with the subfolder path. For instance, if the server is exposed behind `/subpath` and the server sends a response with `Location: /mystream/index.m3u8`, this has to be changed into `Location: /subfolder/mystream/index.m3u8`.
 
-If _nginx_ is the reverse proxy, this can be achieved with the following configuration:
+## Nginx
+
+When _Nginx_ is the reverse proxy, rules described above can be implemented with the following configuration:
 
 ```
 location /subpath/ {
@@ -15,7 +17,9 @@ location /subpath/ {
 }
 ```
 
-If _Apache HTTP Server_ is the reverse proxy, this can be achieved with the following configuration:
+## Apache HTTP Server
+
+When _Apache HTTP Server_ is the reverse proxy, rules described above can be implemented with the following configuration:
 
 ```
 <Location /subpath>
@@ -25,7 +29,9 @@ If _Apache HTTP Server_ is the reverse proxy, this can be achieved with the foll
 </Location>
 ```
 
-If _Caddy_ is the reverse proxy, this can be achieved with the following configuration:
+## Caddy
+
+When _Caddy_ is the reverse proxy, rules described above can be implemented with the following configuration:
 
 ```
 :80 {
diff --git a/docs/2-features/23-metrics.md b/docs/2-features/23-metrics.md
index d3c30a00..91c473de 100644
--- a/docs/2-features/23-metrics.md
+++ b/docs/2-features/23-metrics.md
@@ -149,13 +149,18 @@ webrtc_sessions_outbound_bytes{id="[id]",path="[path]",remoteAddr="[remoteAddr]"
 webrtc_sessions_outbound_rtp_packets{id="[id]",path="[path]",remoteAddr="[remoteAddr]",state="[state]"} 123
 webrtc_sessions_outbound_rtcp_packets{id="[id]",path="[path]",remoteAddr="[remoteAddr]",state="[state]"} 123
 webrtc_sessions_outbound_frames_discarded{id="[id]",path="[path]",remoteAddr="[remoteAddr]",state="[state]"} 12
+
+# MoQ sessions
+moq_sessions{id="[id]",path="[path]",remoteAddr="[remoteAddr]",state="[state]"} 1
+moq_sessions_inbound_bytes{id="[id]",path="[path]",remoteAddr="[remoteAddr]",state="[state]"} 1234
+moq_sessions_outbound_bytes{id="[id]",path="[path]",remoteAddr="[remoteAddr]",state="[state]"} 187
 ```
 
 Bitrates are not provided directly as metrics because they can be computed from received and sent bytes by any metrics analyzer (i.e. Grafana).
 
 Metrics can be filtered by using HTTP query parameters:
 
-- `type=[TYPE]`: show metrics of a certain type only. TYPE can be `paths`, `hls_sessions`, `hls_muxers`, `rtsp_conns`, `rtsp_sessions`, `rtsps_conns`, `rtsps_sessions`, `rtmp_conns`, `rtmps_conns`, `srt_conns`, `webrtc_sessions`.
+- `type=[TYPE]`: show metrics of a certain type only. TYPE can be `paths`, `hls_sessions`, `hls_muxers`, `rtsp_conns`, `rtsp_sessions`, `rtsps_conns`, `rtsps_sessions`, `rtmp_conns`, `rtmps_conns`, `srt_conns`, `webrtc_sessions`, `moq_sessions`.
 - `path=[PATH]`: show metrics belonging to a specific path only
 - `hls_muxer=[PATH]`: show metrics belonging to a specific HLS muxer only
 - `hls_session=[ID]`: show metrics belonging to a specific HLS session only
@@ -167,3 +172,4 @@ Metrics can be filtered by using HTTP query parameters:
 - `rtmps_conn=[ID]` show metrics belonging to a specific RTMPS connection only
 - `srt_conn=[ID]` show metrics belonging to a specific SRT connection only
 - `webrtc_session=[ID]` show metrics belonging to a specific WebRTC session only
+- `moq_session=[ID]` show metrics belonging to a specific MoQ session only
diff --git a/docs/2-features/25-srt-specific-features.md b/docs/2-features/25-srt-specific-features.md
index eb035292..0bde873d 100644
--- a/docs/2-features/25-srt-specific-features.md
+++ b/docs/2-features/25-srt-specific-features.md
@@ -1,6 +1,6 @@
 # SRT-specific features
 
-SRT is a protocol that can be used for publishing and reading streams. Regarding specific tasks, check out [Publish with SRT clients](../3-publish/01-srt-clients.md) and [Read with SRT clients](../4-read/01-srt.md). Features in this page are shared among both tasks.
+SRT is a protocol that can be used for publishing and reading streams. Regarding specific tasks, check out [Publish with SRT clients](../3-publish/02-srt-clients.md) and [Read with SRT clients](../4-read/02-srt.md). Features in this page are shared among both tasks.
 
 ## Standard stream ID syntax
 
diff --git a/docs/2-features/26-webrtc-specific-features.md b/docs/2-features/26-webrtc-specific-features.md
index 2b490644..ab8c86ec 100644
--- a/docs/2-features/26-webrtc-specific-features.md
+++ b/docs/2-features/26-webrtc-specific-features.md
@@ -1,6 +1,6 @@
 # WebRTC-specific features
 
-WebRTC is a protocol that can be used for publishing and reading streams. Regarding specific tasks, check out [Publish with WebRTC clients](../3-publish/03-webrtc-clients.md) and [Read with WebRTC clients](../4-read/02-webrtc.md). Features in this page are shared among both tasks.
+WebRTC is a protocol that can be used for publishing and reading streams. Regarding specific tasks, check out [Publish with WebRTC clients](../3-publish/05-webrtc-clients.md) and [Read with WebRTC clients](../4-read/03-webrtc.md). Features in this page are shared among both tasks.
 
 ## Codec support in browsers
 
diff --git a/docs/2-features/27-rtsp-specific-features.md b/docs/2-features/27-rtsp-specific-features.md
index a2fd5dae..e400e3bf 100644
--- a/docs/2-features/27-rtsp-specific-features.md
+++ b/docs/2-features/27-rtsp-specific-features.md
@@ -1,6 +1,6 @@
 # RTSP-specific features
 
-RTSP is a protocol that can be used for publishing and reading streams. Regarding specific tasks, check out [Publish with RTSP clients](../3-publish/05-rtsp-clients.md) and [Read with RTSP clients](../4-read/03-rtsp.md). Features in this page are shared among both tasks.
+RTSP is a protocol that can be used for publishing and reading streams. Regarding specific tasks, check out [Publish with RTSP clients](../3-publish/07-rtsp-clients.md) and [Read with RTSP clients](../4-read/04-rtsp.md). Features in this page are shared among both tasks.
 
 ## Transport protocols
 
@@ -107,4 +107,4 @@ There are also the `rtsps+http`, `rtsp+ws`, `rtsps+ws` schemas to handle any var
 
 ## MPEG-TS inside RTSP
 
-read [MPEG-TS inside RTSP](../3-publish/05-rtsp-clients.md#mpeg-ts-inside-rtsp) in the "Publish with RTSP clients" page.
+read [MPEG-TS inside RTSP](../3-publish/07-rtsp-clients.md#mpeg-ts-inside-rtsp) in the "Publish with RTSP clients" page.
diff --git a/docs/2-features/28-rtmp-specific-features.md b/docs/2-features/28-rtmp-specific-features.md
index c5ea66d0..da913720 100644
--- a/docs/2-features/28-rtmp-specific-features.md
+++ b/docs/2-features/28-rtmp-specific-features.md
@@ -1,6 +1,6 @@
 # RTMP-specific features
 
-RTMP is a protocol that can be used for publishing and reading streams. Regarding specific tasks, check out [Publish with RTMP clients](../3-publish/07-rtmp-clients.md) and [Read with RTMP clients](../4-read/04-rtmp.md). Features in this page are shared among both tasks.
+RTMP is a protocol that can be used for publishing and reading streams. Regarding specific tasks, check out [Publish with RTMP clients](../3-publish/09-rtmp-clients.md) and [Read with RTMP clients](../4-read/05-rtmp.md). Features in this page are shared among both tasks.
 
 ## Encryption
 
diff --git a/docs/3-publish/01-moq-clients.md b/docs/3-publish/01-moq-clients.md
new file mode 100644
index 00000000..d476fa96
--- /dev/null
+++ b/docs/3-publish/01-moq-clients.md
@@ -0,0 +1,36 @@
+# Media-over-QUIC clients
+
+|           | supported codecs          |
+| --------- | ------------------------- |
+| **video** | AV1, VP9, VP8, H265, H264 |
+| **audio** | Opus, MPEG-4 Audio (AAC)  |
+
+Media-over-QUIC is a streaming protocol built upon cutting edge protocols (QUIC, HTTP3) and browser APIs (WebTransport, WebCodecs) that can be used to publish and read live media streams. It's slightly faster than WebRTC, has an advanced data recovery mechanism, it supports additional codecs (FLAC and future ones) and is less complicated to route.
+
+Media-over-QUIC has a wide range of features and variants, most of them in active development. We currently support the following:
+
+- We support `draft-18` of the [main specification](https://datatracker.ietf.org/doc/html/draft-ietf-moq-transport-18).
+- We only support using Media-over-QUIC through browsers and in particular through the WebTransport API. We do not support using QUIC directly.
+- We support the `PUBLISH` and `SUBSCRIBE` messages only, which are the ones meant to be used by a routing solution like _MediaMTX_.
+- We use the MOQT Streaming Format (MSF) to advertise tracks, described in [this specification](https://datatracker.ietf.org/doc/html/draft-ietf-moq-msf-00).
+- We use the Low Overhead Media Container (LOC) to ship frames, described in [this specification](https://datatracker.ietf.org/doc/draft-ietf-moq-loc/).
+- We host web pages through a HTTP/2 listener and host the WebTransport endpoint through a HTTP/3 listener. This hybrid setup allows to use self-signed certificates, that are normally forbidden in pure HTTP/3.
+
+There are some server requirements:
+
+- HTTPS is mandatory.
+- Clients must be able to access both the HTTP/2 listener (`:8892`) and the HTTP/3 listener (`:8892`), the latter of which runs over UDP.
+
+And there are some client (browser) requirements:
+
+- If the server certificate is self-signed, browser must support the [serverCertificatesHashes option](https://caniuse.com/mdn-api_webtransport_webtransport_options_servercertificatehashes_parameter) (all except iOS safari do).
+- Browser must support [WebTransport](https://caniuse.com/webtransport) and [WebCodecs](https://caniuse.com/webcodecs) (all modern browsers do)
+- When publishing tracks, the browser to support [MediaStreamTrackProcessor](https://caniuse.com/mdn-api_mediastreamtrackprocessor) (only Chrome does).
+
+You can publish a stream with Media-over-QUIC and a web browser by visiting:
+
+```
+https://localhost:8892/mystream/publish
+```
+
+The only clients that can currently publish with Media-over-QUIC are [Web browsers](16-web-browsers.md).
diff --git a/docs/3-publish/01-srt-clients.md b/docs/3-publish/02-srt-clients.md
similarity index 90%
rename from docs/3-publish/01-srt-clients.md
rename to docs/3-publish/02-srt-clients.md
index c06ce85f..3a936259 100644
--- a/docs/3-publish/01-srt-clients.md
+++ b/docs/3-publish/02-srt-clients.md
@@ -18,4 +18,4 @@ If you need to use the standard stream ID syntax instead of the custom one in us
 
 If you want to publish a stream by using a client in listening mode (i.e. with `mode=listener` appended to the URL), read the next section.
 
-Some clients that can publish with SRT are [FFmpeg](15-ffmpeg.md), [GStreamer](16-gstreamer.md), [OBS Studio](17-obs-studio.md).
+Some clients that can publish with SRT are [FFmpeg](17-ffmpeg.md), [GStreamer](18-gstreamer.md), [OBS Studio](19-obs-studio.md).
diff --git a/docs/3-publish/02-srt-cameras-and-servers.md b/docs/3-publish/04-srt-cameras-and-servers.md
similarity index 100%
rename from docs/3-publish/02-srt-cameras-and-servers.md
rename to docs/3-publish/04-srt-cameras-and-servers.md
diff --git a/docs/3-publish/03-webrtc-clients.md b/docs/3-publish/05-webrtc-clients.md
similarity index 91%
rename from docs/3-publish/03-webrtc-clients.md
rename to docs/3-publish/05-webrtc-clients.md
index 335bec1b..74fdc32c 100644
--- a/docs/3-publish/03-webrtc-clients.md
+++ b/docs/3-publish/05-webrtc-clients.md
@@ -23,4 +23,4 @@ Be aware that not all browsers can read any codec, check [Codec support in brows
 
 Depending on the network it might be difficult to establish a connection between server and clients, read [Solving WebRTC connectivity issues](../2-features/26-webrtc-specific-features.md#solving-webrtc-connectivity-issues).
 
-Some clients that can publish with WebRTC and WHIP are [FFmpeg](15-ffmpeg.md), [GStreamer](16-gstreamer.md), [OBS Studio](17-obs-studio.md), [Unity](20-unity.md) and [Web browsers](14-web-browsers.md).
+Some clients that can publish with WebRTC and WHIP are [FFmpeg](17-ffmpeg.md), [GStreamer](18-gstreamer.md), [OBS Studio](19-obs-studio.md), [Unity](22-unity.md) and [Web browsers](16-web-browsers.md).
diff --git a/docs/3-publish/04-webrtc-servers.md b/docs/3-publish/06-webrtc-servers.md
similarity index 93%
rename from docs/3-publish/04-webrtc-servers.md
rename to docs/3-publish/06-webrtc-servers.md
index 34e49f8d..c7bdfe1f 100644
--- a/docs/3-publish/04-webrtc-servers.md
+++ b/docs/3-publish/06-webrtc-servers.md
@@ -14,7 +14,7 @@ paths:
     source: wheps://host:port/path
 ```
 
-If the remote server is a _MediaMTX_ instance, remember to add a `/whep` suffix after the stream name, since in _MediaMTX_ [it's part of the WHEP URL](../4-read/02-webrtc.md):
+If the remote server is a _MediaMTX_ instance, remember to add a `/whep` suffix after the stream name, since in _MediaMTX_ [it's part of the WHEP URL](../4-read/03-webrtc.md):
 
 ```yml
 paths:
diff --git a/docs/3-publish/05-rtsp-clients.md b/docs/3-publish/07-rtsp-clients.md
similarity index 90%
rename from docs/3-publish/05-rtsp-clients.md
rename to docs/3-publish/07-rtsp-clients.md
index 7e6c41bf..1344645e 100644
--- a/docs/3-publish/05-rtsp-clients.md
+++ b/docs/3-publish/07-rtsp-clients.md
@@ -14,7 +14,7 @@ rtsp://localhost:8554/mystream
 
 The resulting stream will be available on path `/mystream`.
 
-Some clients that can publish with RTSP are [FFmpeg](15-ffmpeg.md), [GStreamer](16-gstreamer.md), [OBS Studio](17-obs-studio.md), [Python and OpenCV](18-python-opencv.md).
+Some clients that can publish with RTSP are [FFmpeg](17-ffmpeg.md), [GStreamer](18-gstreamer.md), [OBS Studio](19-obs-studio.md), [Python and OpenCV](20-python-opencv.md).
 
 Advanced RTSP features and settings are described in [RTSP-specific features](../2-features/27-rtsp-specific-features.md).
 
diff --git a/docs/3-publish/06-rtsp-cameras-and-servers.md b/docs/3-publish/08-rtsp-cameras-and-servers.md
similarity index 100%
rename from docs/3-publish/06-rtsp-cameras-and-servers.md
rename to docs/3-publish/08-rtsp-cameras-and-servers.md
diff --git a/docs/3-publish/07-rtmp-clients.md b/docs/3-publish/09-rtmp-clients.md
similarity index 86%
rename from docs/3-publish/07-rtmp-clients.md
rename to docs/3-publish/09-rtmp-clients.md
index fd7b7239..d8db32b6 100644
--- a/docs/3-publish/07-rtmp-clients.md
+++ b/docs/3-publish/09-rtmp-clients.md
@@ -13,4 +13,4 @@ rtmp://localhost/mystream
 
 The resulting stream will be available on path `/mystream`.
 
-Some clients that can publish with RTMP are [FFmpeg](15-ffmpeg.md), [GStreamer](16-gstreamer.md) and [OBS Studio](17-obs-studio.md).
+Some clients that can publish with RTMP are [FFmpeg](17-ffmpeg.md), [GStreamer](18-gstreamer.md) and [OBS Studio](19-obs-studio.md).
diff --git a/docs/3-publish/08-rtmp-cameras-and-servers.md b/docs/3-publish/10-rtmp-cameras-and-servers.md
similarity index 100%
rename from docs/3-publish/08-rtmp-cameras-and-servers.md
rename to docs/3-publish/10-rtmp-cameras-and-servers.md
diff --git a/docs/3-publish/09-hls-cameras-and-servers.md b/docs/3-publish/11-hls-cameras-and-servers.md
similarity index 100%
rename from docs/3-publish/09-hls-cameras-and-servers.md
rename to docs/3-publish/11-hls-cameras-and-servers.md
diff --git a/docs/3-publish/10-mpeg-ts.md b/docs/3-publish/12-mpeg-ts.md
similarity index 96%
rename from docs/3-publish/10-mpeg-ts.md
rename to docs/3-publish/12-mpeg-ts.md
index ba9c5018..32cb91da 100644
--- a/docs/3-publish/10-mpeg-ts.md
+++ b/docs/3-publish/12-mpeg-ts.md
@@ -34,7 +34,7 @@ paths:
     source: udp+mpegts://0.0.0.0:1234?source=192.168.3.5
 ```
 
-Some clients that can publish with UDP and MPEG-TS are [FFmpeg](15-ffmpeg.md) and [GStreamer](16-gstreamer.md).
+Some clients that can publish with UDP and MPEG-TS are [FFmpeg](17-ffmpeg.md) and [GStreamer](18-gstreamer.md).
 
 Unix sockets are more efficient than UDP packets and can be used as transport by specifying the `unix+mpegts` scheme:
 
diff --git a/docs/3-publish/11-rtp.md b/docs/3-publish/13-rtp.md
similarity index 96%
rename from docs/3-publish/11-rtp.md
rename to docs/3-publish/13-rtp.md
index e92086f9..66aa4ed9 100644
--- a/docs/3-publish/11-rtp.md
+++ b/docs/3-publish/13-rtp.md
@@ -27,4 +27,4 @@ paths:
 
 `rtpSDP` must contain a valid SDP, that is a description of the RTP session.
 
-Some clients that can publish with UDP and MPEG-TS are [FFmpeg](15-ffmpeg.md) and [GStreamer](16-gstreamer.md).
+Some clients that can publish with UDP and MPEG-TS are [FFmpeg](17-ffmpeg.md) and [GStreamer](18-gstreamer.md).
diff --git a/docs/3-publish/12-raspberry-pi-cameras.md b/docs/3-publish/14-raspberry-pi-cameras.md
similarity index 100%
rename from docs/3-publish/12-raspberry-pi-cameras.md
rename to docs/3-publish/14-raspberry-pi-cameras.md
diff --git a/docs/3-publish/13-generic-webcams.md b/docs/3-publish/15-generic-webcams.md
similarity index 100%
rename from docs/3-publish/13-generic-webcams.md
rename to docs/3-publish/15-generic-webcams.md
diff --git a/docs/3-publish/14-web-browsers.md b/docs/3-publish/16-web-browsers.md
similarity index 58%
rename from docs/3-publish/14-web-browsers.md
rename to docs/3-publish/16-web-browsers.md
index a33a5d59..970b345a 100644
--- a/docs/3-publish/14-web-browsers.md
+++ b/docs/3-publish/16-web-browsers.md
@@ -1,6 +1,26 @@
 # Web browsers
 
-Web browsers can publish a stream to the server by using the [WebRTC protocol](03-webrtc-clients.md). Start the server and open the web page:
+Web browsers can publish a stream to the server by acting as a [Media-over-QUIC client](01-moq-clients.md) or a [WebRTC client](05-webrtc-clients.md).
+
+## Media-over-QUIC
+
+Start the server and open the web page:
+
+```
+https://localhost:8892/mystream/publish
+```
+
+The resulting stream will be available on path `/mystream`.
+
+This web page can be embedded into another web page by using an iframe:
+
+```html
+<iframe src="https://mediamtx-ip:8892/mystream/publish" scrolling="no"></iframe>
+```
+
+## WebRTC
+
+Start the server and open the web page:
 
 ```
 http://localhost:8889/mystream/publish
diff --git a/docs/3-publish/15-ffmpeg.md b/docs/3-publish/17-ffmpeg.md
similarity index 75%
rename from docs/3-publish/15-ffmpeg.md
rename to docs/3-publish/17-ffmpeg.md
index 633150cd..9d4727fe 100644
--- a/docs/3-publish/15-ffmpeg.md
+++ b/docs/3-publish/17-ffmpeg.md
@@ -1,8 +1,8 @@
 # FFmpeg
 
-FFmpeg can publish a stream to the server by using the [RTSP](05-rtsp-clients.md), [RTMP](07-rtmp-clients.md), [MPEG-TS](10-mpeg-ts.md), [RTP](11-rtp.md), [SRT](01-srt-clients.md) and [WebRTC](03-webrtc-clients.md) protocols. The recommended one is RTSP.
+FFmpeg can publish a stream to the server by acting as a [RTSP client](07-rtsp-clients.md), [RTMP client](09-rtmp-clients.md), [SRT client](02-srt-clients.md), [WebRTC client](05-webrtc-clients.md) or by sending [MPEG-TS packets](12-mpeg-ts.md) or [RTP packets](13-rtp.md). The recommended way is acting as a RTSP client.
 
-## FFmpeg and RTSP
+## FFmpeg as a RTSP client
 
 ```sh
 ffmpeg -re -stream_loop -1 -i file.mp4 -c copy -f rtsp rtsp://localhost:8554/mystream
@@ -10,7 +10,7 @@ ffmpeg -re -stream_loop -1 -i file.mp4 -c copy -f rtsp rtsp://localhost:8554/mys
 
 The resulting stream will be available on path `/mystream`.
 
-## FFmpeg and RTMP
+## FFmpeg as a RTMP client
 
 ```sh
 ffmpeg -re -stream_loop -1 -i file.mp4 -c copy -f flv rtmp://localhost:1935/mystream
@@ -36,7 +36,7 @@ ffmpeg -re -f lavfi -i testsrc=size=1280x720:rate=30 \
 
 ## FFmpeg and RTP over UDP
 
-In _MediaMTX_ configuration, add a path with `source: udp+rtp://238.0.0.1:1234` and a valid `rtpSDP` (read [RTP](11-rtp.md)). Then:
+In _MediaMTX_ configuration, add a path with `source: udp+rtp://238.0.0.1:1234` and a valid `rtpSDP` (read [RTP](13-rtp.md)). Then:
 
 ```sh
 ffmpeg -re -f lavfi -i testsrc=size=1280x720:rate=30 \
@@ -44,13 +44,13 @@ ffmpeg -re -f lavfi -i testsrc=size=1280x720:rate=30 \
 -f rtp udp://238.0.0.1:1234?pkt_size=1316
 ```
 
-## FFmpeg and SRT
+## FFmpeg as a SRT client
 
 ```sh
 ffmpeg -re -stream_loop -1 -i file.mp4 -c copy -f mpegts 'srt://localhost:8890?streamid=publish:stream&pkt_size=1316'
 ```
 
-## FFmpeg and WebRTC
+## FFmpeg as a WebRTC client
 
 ```sh
 ffmpeg -re -f lavfi -i testsrc=size=1280x720:rate=30 \
diff --git a/docs/3-publish/16-gstreamer.md b/docs/3-publish/18-gstreamer.md
similarity index 81%
rename from docs/3-publish/16-gstreamer.md
rename to docs/3-publish/18-gstreamer.md
index 51e0421d..89af78b1 100644
--- a/docs/3-publish/16-gstreamer.md
+++ b/docs/3-publish/18-gstreamer.md
@@ -1,8 +1,8 @@
 # GStreamer
 
-GStreamer can publish a stream to the server by using the [RTSP](05-rtsp-clients.md), [RTMP](07-rtmp-clients.md), [SRT](01-srt-clients.md), [MPEG-TS](10-mpeg-ts.md) and [WebRTC](03-webrtc-clients.md) protocols. The recommended one is RTSP.
+GStreamer can publish a stream to the server by acting as a [RTSP client](07-rtsp-clients.md), [RTMP client](09-rtmp-clients.md), [SRT client](02-srt-clients.md), [WebRTC client](05-webrtc-clients.md) or by sending [MPEG-TS packets](12-mpeg-ts.md). The recommended way is acting as a RTSP client.
 
-## GStreamer and RTSP
+## GStreamer as a RTSP client
 
 ```sh
 gst-launch-1.0 rtspclientsink name=s location=rtsp://localhost:8554/mystream \
@@ -20,7 +20,7 @@ d.video_0 ! rtspclientsink location=rtsp://localhost:8554/mystream
 
 The resulting stream will be available on path `/mystream`.
 
-## GStreamer and RTMP
+## GStreamer as a RTMP client
 
 ```sh
 gst-launch-1.0 -v flvmux name=mux ! rtmpsink location=rtmp://localhost/stream \
@@ -28,7 +28,7 @@ videotestsrc ! video/x-raw,width=1280,height=720,format=I420 ! x264enc speed-pre
 audiotestsrc ! audioconvert ! avenc_aac ! mux.
 ```
 
-## GStreamer and SRT
+## GStreamer as a SRT client
 
 ```sh
 gst-launch-1.0 -v mpegtsmux name=mux ! srtsink uri="srt://localhost:8890?streamid=publish:mystream&pkt_size=1316" \
@@ -46,7 +46,7 @@ videotestsrc ! video/x-raw,width=1280,height=720,format=I420 ! x264enc speed-pre
 audiotestsrc ! audioconvert ! avenc_aac ! mux.
 ```
 
-## GStreamer and WebRTC
+## GStreamer as a WebRTC client
 
 Make sure that GStreamer version is at least 1.22, and that if the codec is H264, the profile is baseline. Use the `whipclientsink` element:
 
diff --git a/docs/3-publish/17-obs-studio.md b/docs/3-publish/19-obs-studio.md
similarity index 95%
rename from docs/3-publish/17-obs-studio.md
rename to docs/3-publish/19-obs-studio.md
index ab3a1183..4cd0a14d 100644
--- a/docs/3-publish/17-obs-studio.md
+++ b/docs/3-publish/19-obs-studio.md
@@ -1,8 +1,8 @@
 # OBS Studio
 
-OBS Studio can publish streams to the server by using the [RTMP](07-rtmp-clients.md) and [WebRTC](03-webrtc-clients.md) protocols. The recommended one is RTMP.
+OBS Studio can publish streams to the server by acting as a [RTMP client](09-rtmp-clients.md) or a [WebRTC client](05-webrtc-clients.md) protocols. The recommended way is acting as a RTMP client.
 
-## OBS Studio and RTMP
+## OBS Studio as a RTMP client
 
 ### Standard
 
@@ -173,11 +173,11 @@ OBS Studio requires _MediaMTX_ to use a TLS certificate signed by a public certi
    certutil -addstore "Root" myca.crt
    ```
 
-## OBS Studio and WebRTC
+## OBS Studio as a WebRTC client
 
 ### Standard
 
-Recent versions of OBS Studio can also publish streams to the server with the [WebRTC / WHIP protocol](03-webrtc-clients.md) Use the following parameters:
+Recent versions of OBS Studio can also publish streams to the server with the [WebRTC / WHIP protocol](05-webrtc-clients.md) Use the following parameters:
 
 - Service: `WHIP`
 - Server: `http://localhost:8889/mystream/whip`
diff --git a/docs/3-publish/18-python-opencv.md b/docs/3-publish/20-python-opencv.md
similarity index 96%
rename from docs/3-publish/18-python-opencv.md
rename to docs/3-publish/20-python-opencv.md
index cb7dbfc8..e04adc0d 100644
--- a/docs/3-publish/18-python-opencv.md
+++ b/docs/3-publish/20-python-opencv.md
@@ -1,6 +1,6 @@
 # Python and OpenCV
 
-Python-based software can publish streams to the server with the OpenCV library and its GStreamer plugin, acting as a [RTSP client](05-rtsp-clients.md). OpenCV must be compiled with support for GStreamer, by following this procedure:
+Python-based software can publish streams to the server with the OpenCV library and its GStreamer plugin, acting as a [RTSP client](07-rtsp-clients.md). OpenCV must be compiled with support for GStreamer, by following this procedure:
 
 ```sh
 sudo apt install -y libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev gstreamer1.0-plugins-ugly gstreamer1.0-rtsp python3-dev python3-numpy
diff --git a/docs/3-publish/19-golang.md b/docs/3-publish/21-golang.md
similarity index 100%
rename from docs/3-publish/19-golang.md
rename to docs/3-publish/21-golang.md
diff --git a/docs/3-publish/20-unity.md b/docs/3-publish/22-unity.md
similarity index 98%
rename from docs/3-publish/20-unity.md
rename to docs/3-publish/22-unity.md
index c730b370..45f32f60 100644
--- a/docs/3-publish/20-unity.md
+++ b/docs/3-publish/22-unity.md
@@ -1,6 +1,6 @@
 # Unity
 
-Software written with the Unity Engine can publish a stream to the server by using the [WebRTC protocol](03-webrtc-clients.md).
+Software written with the Unity Engine can publish a stream to the server by acting as a [WebRTC client](05-webrtc-clients.md).
 
 Create a new Unity project or open an existing one.
 
diff --git a/docs/4-read/01-moq.md b/docs/4-read/01-moq.md
new file mode 100644
index 00000000..b79e8667
--- /dev/null
+++ b/docs/4-read/01-moq.md
@@ -0,0 +1,18 @@
+# Media-over-QUIC clients
+
+|           | supported codecs                                        |
+| --------- | ------------------------------------------------------- |
+| **video** | AV1, VP9, VP8, H265, H264                               |
+| **audio** | Opus, FLAC, MPEG-4 Audio (AAC), G711 (PCMA, PCMU), LPCM |
+
+Media-over-QUIC is a streaming protocol built upon cutting edge protocols (QUIC, HTTP3) and browser APIs (WebTransport, WebCodecs) that can be used to publish and read live media streams. It's slightly faster than WebRTC, has an advanced data recovery mechanism, it supports additional codecs (FLAC and future ones) and is less complicated to route.
+
+There are some limitations and requirements that are listed in [Publish with Media-over-QUIC clients](../3-publish/01-moq-clients.md).
+
+You can read a stream with Media-over-QUIC and a web browser by visiting:
+
+```
+https://localhost:8892/mystream/publish
+```
+
+The only clients that can currently read with Media-over-QUIC are [Web browsers](07-web-browsers.md).
diff --git a/docs/4-read/01-srt.md b/docs/4-read/02-srt.md
similarity index 89%
rename from docs/4-read/01-srt.md
rename to docs/4-read/02-srt.md
index a40f419a..2fba8bc5 100644
--- a/docs/4-read/01-srt.md
+++ b/docs/4-read/02-srt.md
@@ -16,4 +16,4 @@ Replace `mystream` with the path name.
 
 If you need to use the standard stream ID syntax instead of the custom one in use by this server, read [Standard stream ID syntax](../2-features/25-srt-specific-features.md#standard-stream-id-syntax).
 
-Some clients that can read with SRT are [FFmpeg](07-ffmpeg.md), [GStreamer](08-gstreamer.md) and [VLC](09-vlc.md).
+Some clients that can read with SRT are [FFmpeg](08-ffmpeg.md), [GStreamer](09-gstreamer.md) and [VLC](10-vlc.md).
diff --git a/docs/4-read/02-webrtc.md b/docs/4-read/03-webrtc.md
similarity index 95%
rename from docs/4-read/02-webrtc.md
rename to docs/4-read/03-webrtc.md
index a7a18081..e4ce2314 100644
--- a/docs/4-read/02-webrtc.md
+++ b/docs/4-read/03-webrtc.md
@@ -22,4 +22,4 @@ Be aware that not all browsers can read any codec, check [Codec support in brows
 
 Depending on the network it may be difficult to establish a connection between server and clients, read [Solving WebRTC connectivity issues](../2-features/26-webrtc-specific-features.md#solving-webrtc-connectivity-issues).
 
-Some clients that can read with WebRTC and WHEP are [GStreamer](08-gstreamer.md), [Unity](13-unity.md) and [web browsers](06-web-browsers.md).
+Some clients that can read with WebRTC and WHEP are [GStreamer](09-gstreamer.md), [Unity](14-unity.md) and [web browsers](07-web-browsers.md).
diff --git a/docs/4-read/03-rtsp.md b/docs/4-read/04-rtsp.md
similarity index 88%
rename from docs/4-read/03-rtsp.md
rename to docs/4-read/04-rtsp.md
index c1c51270..46debc73 100644
--- a/docs/4-read/03-rtsp.md
+++ b/docs/4-read/04-rtsp.md
@@ -12,4 +12,4 @@ RTSP is a protocol that allows to publish and read streams. It supports several
 rtsp://localhost:8554/mystream
 ```
 
-Some clients that can read with RTSP are [FFmpeg](07-ffmpeg.md), [GStreamer](08-gstreamer.md) and [VLC](09-vlc.md).
+Some clients that can read with RTSP are [FFmpeg](08-ffmpeg.md), [GStreamer](09-gstreamer.md) and [VLC](10-vlc.md).
diff --git a/docs/4-read/04-rtmp.md b/docs/4-read/05-rtmp.md
similarity index 86%
rename from docs/4-read/04-rtmp.md
rename to docs/4-read/05-rtmp.md
index 108b10b0..c35b7916 100644
--- a/docs/4-read/04-rtmp.md
+++ b/docs/4-read/05-rtmp.md
@@ -11,4 +11,4 @@ RTMP is a protocol that allows to read and publish streams. It has been expanded
 rtmp://localhost/mystream
 ```
 
-Some clients that can read with RTMP are [FFmpeg](07-ffmpeg.md), [GStreamer](08-gstreamer.md) and [VLC](09-vlc.md).
+Some clients that can read with RTMP are [FFmpeg](08-ffmpeg.md), [GStreamer](09-gstreamer.md) and [VLC](10-vlc.md).
diff --git a/docs/4-read/05-hls.md b/docs/4-read/06-hls.md
similarity index 96%
rename from docs/4-read/05-hls.md
rename to docs/4-read/06-hls.md
index be12a930..aefcc92f 100644
--- a/docs/4-read/05-hls.md
+++ b/docs/4-read/06-hls.md
@@ -18,7 +18,7 @@ and can also be accessed without using the browsers, by software that supports t
 http://localhost:8888/mystream/index.m3u8
 ```
 
-Some clients that can read with HLS are [FFmpeg](07-ffmpeg.md), [GStreamer](08-gstreamer.md), [VLC](09-vlc.md) and [web browsers](06-web-browsers.md).
+Some clients that can read with HLS are [FFmpeg](08-ffmpeg.md), [GStreamer](09-gstreamer.md), [VLC](10-vlc.md) and [web browsers](07-web-browsers.md).
 
 _MediaMTX_ supports generating HLS in several variants (including Low-Latency mode), and provides various parameters to tune HLS generation. These are listed in the [configuration file](../5-references/1-configuration-file.md):
 
diff --git a/docs/4-read/06-web-browsers.md b/docs/4-read/07-web-browsers.md
similarity index 90%
rename from docs/4-read/06-web-browsers.md
rename to docs/4-read/07-web-browsers.md
index fbf5e39e..55c7b0b7 100644
--- a/docs/4-read/06-web-browsers.md
+++ b/docs/4-read/07-web-browsers.md
@@ -1,9 +1,19 @@
 # Web browsers
 
-Web browsers can read a stream from the server with the [WebRTC](02-webrtc.md) and [HLS](05-hls.md) protocols, by accessing web pages hosted by the server. It is also possible to embed streams into an external website.
+Web browsers can read a stream from the server with the [Media-over-QUIC](01-moq.md), [WebRTC](03-webrtc.md) and [HLS](06-hls.md) protocols, by accessing web pages hosted by the server. It is also possible to embed streams into an external website.
 
 ## Direct read
 
+### Media-over-QUIC
+
+Visit the web page:
+
+```
+https://localhost:8892/mystream
+```
+
+Replace `mystream` with the path name.
+
 ### WebRTC
 
 Visit the web page:
@@ -28,6 +38,14 @@ Replace `mystream` with the path name.
 
 Live streams can be embedded into an external website by using the WebRTC or HLS protocol. Before embedding, check that the stream is ready and can be accessed with intended protocol by visiting web pages mentioned in the previous section.
 
+### Media-over-QUIC in iframe
+
+The simplest way to embed a live stream in a web page, using the Media-over-QUIC protocol, consists in adding an `<iframe>` tag to the body section of the HTML:
+
+```html
+<iframe src="https://mediamtx-ip:8892/mystream" scrolling="no"></iframe>
+```
+
 ### WebRTC in iframe
 
 The simplest way to embed a live stream in a web page, using the WebRTC protocol, consists in adding an `<iframe>` tag to the body section of the HTML:
diff --git a/docs/4-read/07-ffmpeg.md b/docs/4-read/08-ffmpeg.md
similarity index 84%
rename from docs/4-read/07-ffmpeg.md
rename to docs/4-read/08-ffmpeg.md
index e4218f2c..e2e2c3f4 100644
--- a/docs/4-read/07-ffmpeg.md
+++ b/docs/4-read/08-ffmpeg.md
@@ -1,6 +1,6 @@
 # FFmpeg
 
-FFmpeg can read a stream from the server the [RTSP](03-rtsp.md), [RTMP](04-rtmp.md), [HLS](05-hls.md) and [SRT](01-srt.md) protocols. The recommended one is RTSP.
+FFmpeg can read a stream from the server the [RTSP](04-rtsp.md), [RTMP](05-rtmp.md), [HLS](06-hls.md) and [SRT](02-srt.md) protocols. The recommended one is RTSP.
 
 ## FFmpeg and RTSP
 
diff --git a/docs/4-read/08-gstreamer.md b/docs/4-read/09-gstreamer.md
similarity index 94%
rename from docs/4-read/08-gstreamer.md
rename to docs/4-read/09-gstreamer.md
index 43b10a21..aee2fb29 100644
--- a/docs/4-read/08-gstreamer.md
+++ b/docs/4-read/09-gstreamer.md
@@ -1,6 +1,6 @@
 # GStreamer
 
-GStreamer can read a stream from the server by using the [RTSP](03-rtsp.md), [RTMP](04-rtmp.md), [HLS](05-hls.md), [SRT](01-srt.md) and [WebRTC](02-webrtc.md) protocols. The recommended one is RTSP.
+GStreamer can read a stream from the server by using the [RTSP](04-rtsp.md), [RTMP](05-rtmp.md), [HLS](06-hls.md), [SRT](02-srt.md) and [WebRTC](03-webrtc.md) protocols. The recommended one is RTSP.
 
 ## GStreamer and RTSP
 
diff --git a/docs/4-read/09-vlc.md b/docs/4-read/10-vlc.md
similarity index 90%
rename from docs/4-read/09-vlc.md
rename to docs/4-read/10-vlc.md
index cc623fb6..eca44d3b 100644
--- a/docs/4-read/09-vlc.md
+++ b/docs/4-read/10-vlc.md
@@ -1,6 +1,6 @@
 # VLC
 
-VLC can read a stream from the server by using the [RTSP](03-rtsp.md), [RTMP](04-rtmp.md), [HLS](05-hls.md) and [SRT](01-srt.md) protocols. The recommended one is RTSP.
+VLC can read a stream from the server by using the [RTSP](04-rtsp.md), [RTMP](05-rtmp.md), [HLS](06-hls.md) and [SRT](02-srt.md) protocols. The recommended one is RTSP.
 
 In order to minimize latency, it is also suggested to change the `Network caching` parameter of VLC:
 
diff --git a/docs/4-read/10-obs-studio.md b/docs/4-read/11-obs-studio.md
similarity index 91%
rename from docs/4-read/10-obs-studio.md
rename to docs/4-read/11-obs-studio.md
index 9713a783..86f33bb6 100644
--- a/docs/4-read/10-obs-studio.md
+++ b/docs/4-read/11-obs-studio.md
@@ -1,6 +1,6 @@
 # OBS Studio
 
-OBS Studio can read streams from the server by using the [RTSP protocol](03-rtsp.md).
+OBS Studio can read streams from the server by using the [RTSP protocol](04-rtsp.md).
 
 Open OBS, click on _Add Source_, _Media source_, _OK_, uncheck _Local file_, insert in _Input_:
 
diff --git a/docs/4-read/11-python-opencv.md b/docs/4-read/12-python-opencv.md
similarity index 89%
rename from docs/4-read/11-python-opencv.md
rename to docs/4-read/12-python-opencv.md
index 1135eaf0..e397efd3 100644
--- a/docs/4-read/11-python-opencv.md
+++ b/docs/4-read/12-python-opencv.md
@@ -1,6 +1,6 @@
 # Python and OpenCV
 
-Python-based software can read streams from the server with the OpenCV library, acting as a [RTSP client](03-rtsp.md).
+Python-based software can read streams from the server with the OpenCV library, acting as a [RTSP client](04-rtsp.md).
 
 ```python
 import cv2
diff --git a/docs/4-read/12-golang.md b/docs/4-read/13-golang.md
similarity index 100%
rename from docs/4-read/12-golang.md
rename to docs/4-read/13-golang.md
diff --git a/docs/4-read/13-unity.md b/docs/4-read/14-unity.md
similarity index 98%
rename from docs/4-read/13-unity.md
rename to docs/4-read/14-unity.md
index 41b26637..bccda7e7 100644
--- a/docs/4-read/13-unity.md
+++ b/docs/4-read/14-unity.md
@@ -1,6 +1,6 @@
 # Unity
 
-Software written with the Unity Engine can read a stream from the server by using the [WebRTC protocol](02-webrtc.md).
+Software written with the Unity Engine can read a stream from the server by using the [WebRTC protocol](03-webrtc.md).
 
 Create a new Unity project or open an existing one.
 
diff --git a/docs/6-misc/4-specifications.md b/docs/6-misc/4-specifications.md
index 78702ca8..6be3e375 100644
--- a/docs/6-misc/4-specifications.md
+++ b/docs/6-misc/4-specifications.md
@@ -1,18 +1,23 @@
 # Specifications
 
-| name                                                                                                          | area           |
-| ------------------------------------------------------------------------------------------------------------- | -------------- |
-| [RTSP / RTP / RTCP specifications](https://github.com/bluenviron/gortsplib#specifications)                    | RTSP           |
-| [HLS specifications](https://github.com/bluenviron/gohlslib#specifications)                                   | HLS            |
-| [RTMP specifications](https://github.com/bluenviron/gortmplib#specifications)                                 | RTMP           |
-| [WebRTC: Real-Time Communication in Browsers](https://www.w3.org/TR/webrtc/)                                  | WebRTC         |
-| [RFC8835, Transports for WebRTC](https://datatracker.ietf.org/doc/html/rfc8835)                               | WebRTC         |
-| [RFC7742, WebRTC Video Processing and Codec Requirements](https://datatracker.ietf.org/doc/html/rfc7742)      | WebRTC         |
-| [RFC7874, WebRTC Audio Codec and Processing Requirements](https://datatracker.ietf.org/doc/html/rfc7874)      | WebRTC         |
-| [RFC7875, Additional WebRTC Audio Codecs for Interoperability](https://datatracker.ietf.org/doc/html/rfc7875) | WebRTC         |
-| [H.265 Profile for WebRTC](https://datatracker.ietf.org/doc/html/draft-ietf-avtcore-hevc-webrtc-08)           | WebRTC         |
-| [RFC9725, WebRTC-HTTP Ingestion Protocol (WHIP)](https://datatracker.ietf.org/doc/html/rfc9725)               | WebRTC         |
-| [WebRTC-HTTP Egress Protocol (WHEP)](https://datatracker.ietf.org/doc/html/draft-ietf-wish-whep)              | WebRTC         |
-| [The SRT Protocol](https://haivision.github.io/srt-rfc/draft-sharabayko-srt.html)                             | SRT            |
-| [Codec specifications](https://github.com/bluenviron/mediacommon#specifications)                              | codecs         |
-| [Golang project layout](https://github.com/golang-standards/project-layout)                                   | project layout |
+| name                                                                                                          | area            |
+| ------------------------------------------------------------------------------------------------------------- | --------------- |
+| [RTSP / RTP / RTCP specifications](https://github.com/bluenviron/gortsplib#specifications)                    | RTSP            |
+| [HLS specifications](https://github.com/bluenviron/gohlslib#specifications)                                   | HLS             |
+| [RTMP specifications](https://github.com/bluenviron/gortmplib#specifications)                                 | RTMP            |
+| [WebRTC: Real-Time Communication in Browsers](https://www.w3.org/TR/webrtc/)                                  | WebRTC          |
+| [RFC8835, Transports for WebRTC](https://datatracker.ietf.org/doc/html/rfc8835)                               | WebRTC          |
+| [RFC7742, WebRTC Video Processing and Codec Requirements](https://datatracker.ietf.org/doc/html/rfc7742)      | WebRTC          |
+| [RFC7874, WebRTC Audio Codec and Processing Requirements](https://datatracker.ietf.org/doc/html/rfc7874)      | WebRTC          |
+| [RFC7875, Additional WebRTC Audio Codecs for Interoperability](https://datatracker.ietf.org/doc/html/rfc7875) | WebRTC          |
+| [H.265 Profile for WebRTC](https://datatracker.ietf.org/doc/html/draft-ietf-avtcore-hevc-webrtc-08)           | WebRTC          |
+| [RFC9725, WebRTC-HTTP Ingestion Protocol (WHIP)](https://datatracker.ietf.org/doc/html/rfc9725)               | WebRTC          |
+| [WebRTC-HTTP Egress Protocol (WHEP)](https://datatracker.ietf.org/doc/html/draft-ietf-wish-whep)              | WebRTC          |
+| [RFC9000, QUIC: A UDP-Based Multiplexed and Secure Transport](https://datatracker.ietf.org/doc/html/rfc9000)  | Media-over-QUIC |
+| [RFC9114, HTTP/3](https://datatracker.ietf.org/doc/html/rfc9114)                                              | Media-over-QUIC |
+| [Media over QUIC Transport](https://datatracker.ietf.org/doc/html/draft-ietf-moq-transport)                   | Media-over-QUIC |
+| [MOQT Streaming Format (MSF)](https://datatracker.ietf.org/doc/html/draft-ietf-moq-msf-00)                    | Media-over-QUIC |
+| [Low Overhead Media Container (LOC)](https://datatracker.ietf.org/doc/draft-ietf-moq-loc/)                    | Media-over-QUIC |
+| [The SRT Protocol](https://haivision.github.io/srt-rfc/draft-sharabayko-srt.html)                             | SRT             |
+| [Codec specifications](https://github.com/bluenviron/mediacommon#specifications)                              | codecs          |
+| [Golang project layout](https://github.com/golang-standards/project-layout)                                   | project layout  |
diff --git a/docs/6-misc/5-related-projects.md b/docs/6-misc/5-related-projects.md
index 86cf1d15..577f6374 100644
--- a/docs/6-misc/5-related-projects.md
+++ b/docs/6-misc/5-related-projects.md
@@ -10,6 +10,8 @@
 - [pion/sdp (SDP library used internally)](https://github.com/pion/sdp)
 - [pion/rtp (RTP library used internally)](https://github.com/pion/rtp)
 - [pion/rtcp (RTCP library used internally)](https://github.com/pion/rtcp)
+- [quic-go/quic-go (QUIC library used internally)](https://github.com/quic-go/quic-go)
+- [quic-go/webtransport-go (WebTransport library used internally)](https://github.com/quic-go/webtransport-go)
 - [go-astits (MPEG-TS library used internally)](https://github.com/asticode/go-astits)
 - [go-mp4 (MP4 library used internally)](https://github.com/abema/go-mp4)
 - [hls.js (browser-side HLS library used internally)](https://github.com/video-dev/hls.js)
diff --git a/go.mod b/go.mod
index d88dddb6..d42463d0 100644
--- a/go.mod
+++ b/go.mod
@@ -37,10 +37,13 @@ require (
 	github.com/pion/sdp/v3 v3.0.18
 	github.com/pion/transport/v4 v4.0.2
 	github.com/pion/webrtc/v4 v4.2.14
+	github.com/quic-go/quic-go v0.59.0
+	github.com/quic-go/webtransport-go v0.10.0
 	github.com/stretchr/testify v1.11.1
 	github.com/wlynxg/anet v0.0.5
 	golang.org/x/crypto v0.52.0
 	golang.org/x/net v0.55.0
+	golang.org/x/sync v0.20.0
 	golang.org/x/sys v0.45.0
 	golang.org/x/term v0.43.0
 )
@@ -59,6 +62,7 @@ require (
 	github.com/cloudwego/base64x v0.1.6 // indirect
 	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/dunglas/httpsfv v1.1.0 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.12 // indirect
 	github.com/gin-contrib/sse v1.1.0 // indirect
@@ -88,7 +92,6 @@ require (
 	github.com/pjbgf/sha1cd v0.6.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
-	github.com/quic-go/quic-go v0.59.0 // indirect
 	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
 	github.com/skeema/knownhosts v1.3.1 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
diff --git a/go.sum b/go.sum
index f0da9a45..d2ec2408 100644
--- a/go.sum
+++ b/go.sum
@@ -61,6 +61,8 @@ github.com/datarhei/gosrt v0.11.0/go.mod h1:F5B25N3CFf68K4igNLQ1iARcKDbkv8riymjT
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dunglas/httpsfv v1.1.0 h1:Jw76nAyKWKZKFrpMMcL76y35tOpYHqQPzHQiwDvpe54=
+github.com/dunglas/httpsfv v1.1.0/go.mod h1:zID2mqw9mFsnt7YC3vYQ9/cjq30q41W+1AnDwH8TiMg=
 github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
 github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
@@ -206,6 +208,8 @@ github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
 github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
 github.com/quic-go/quic-go v0.59.0 h1:OLJkp1Mlm/aS7dpKgTc6cnpynnD2Xg7C1pwL6vy/SAw=
 github.com/quic-go/quic-go v0.59.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
+github.com/quic-go/webtransport-go v0.10.0 h1:LqXXPOXuETY5Xe8ITdGisBzTYmUOy5eSj+9n4hLTjHI=
+github.com/quic-go/webtransport-go v0.10.0/go.mod h1:LeGIXr5BQKE3UsynwVBeQrU1TPrbh73MGoC6jd+V7ow=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
diff --git a/internal/api/api.go b/internal/api/api.go
index 2da565e3..5646b5ba 100644
--- a/internal/api/api.go
+++ b/internal/api/api.go
@@ -81,6 +81,7 @@ type API struct {
 	HLSServer      defs.APIHLSServer
 	WebRTCServer   defs.APIWebRTCServer
 	SRTServer      defs.APISRTServer
+	MoQServer      defs.APIMoQServer
 	Parent         apiParent
 
 	httpServer *httpp.Server
@@ -91,7 +92,6 @@ type API struct {
 func (a *API) Initialize() error {
 	router := gin.New()
 	router.SetTrustedProxies(a.TrustedProxies.ToTrustedProxies()) //nolint:errcheck
-
 	router.Use(a.middlewarePreflightRequests)
 	router.Use(a.middlewareAuth)
 
@@ -165,6 +165,12 @@ func (a *API) Initialize() error {
 		group.POST("/srtconns/kick/:id", a.onSRTConnsKick)
 	}
 
+	if !interfaceIsEmpty(a.MoQServer) {
+		group.GET("/moqsessions/list", a.onMoQSessionsList)
+		group.GET("/moqsessions/get/:id", a.onMoQSessionsGet)
+		group.POST("/moqsessions/kick/:id", a.onMoQSessionsKick)
+	}
+
 	group.GET("/recordings/list", a.onRecordingsList)
 	group.GET("/recordings/get/*name", a.onRecordingsGet)
 	group.DELETE("/recordings/deletesegment", a.onRecordingDeleteSegment)
@@ -187,7 +193,7 @@ func (a *API) Initialize() error {
 		return err
 	}
 
-	str := "listener opened on " + a.Address
+	str := "started with listener on " + a.Address
 	if !a.Encryption {
 		str += " (TCP/HTTP)"
 	} else {
@@ -200,7 +206,7 @@ func (a *API) Initialize() error {
 
 // Close closes the API.
 func (a *API) Close() {
-	a.Log(logger.Info, "listener is closing")
+	a.Log(logger.Info, "closing")
 	a.httpServer.Close()
 }
 
diff --git a/internal/api/api_moq.go b/internal/api/api_moq.go
new file mode 100644
index 00000000..c6d2646d
--- /dev/null
+++ b/internal/api/api_moq.go
@@ -0,0 +1,68 @@
+package api //nolint:revive,dupl
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/bluenviron/mediamtx/internal/servers/moq"
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+func (a *API) onMoQSessionsList(ctx *gin.Context) {
+	data, err := a.MoQServer.APISessionsList()
+	if err != nil {
+		a.writeError(ctx, http.StatusInternalServerError, err)
+		return
+	}
+
+	data.ItemCount = len(data.Items)
+	pageCount, err := paginate(&data.Items, ctx.Query("itemsPerPage"), ctx.Query("page"))
+	if err != nil {
+		a.writeError(ctx, http.StatusBadRequest, err)
+		return
+	}
+	data.PageCount = pageCount
+
+	ctx.JSON(http.StatusOK, data)
+}
+
+func (a *API) onMoQSessionsGet(ctx *gin.Context) {
+	id, err := uuid.Parse(ctx.Param("id"))
+	if err != nil {
+		a.writeError(ctx, http.StatusBadRequest, err)
+		return
+	}
+
+	data, err := a.MoQServer.APISessionsGet(id)
+	if err != nil {
+		if errors.Is(err, moq.ErrSessionNotFound) {
+			a.writeError(ctx, http.StatusNotFound, err)
+		} else {
+			a.writeError(ctx, http.StatusInternalServerError, err)
+		}
+		return
+	}
+
+	ctx.JSON(http.StatusOK, data)
+}
+
+func (a *API) onMoQSessionsKick(ctx *gin.Context) {
+	id, err := uuid.Parse(ctx.Param("id"))
+	if err != nil {
+		a.writeError(ctx, http.StatusBadRequest, err)
+		return
+	}
+
+	err = a.MoQServer.APISessionsKick(id)
+	if err != nil {
+		if errors.Is(err, moq.ErrSessionNotFound) {
+			a.writeError(ctx, http.StatusNotFound, err)
+		} else {
+			a.writeError(ctx, http.StatusInternalServerError, err)
+		}
+		return
+	}
+
+	a.writeOK(ctx)
+}
diff --git a/internal/api/api_moq_test.go b/internal/api/api_moq_test.go
new file mode 100644
index 00000000..3cbaa4a6
--- /dev/null
+++ b/internal/api/api_moq_test.go
@@ -0,0 +1,181 @@
+package api //nolint:revive
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/bluenviron/mediamtx/internal/conf"
+	"github.com/bluenviron/mediamtx/internal/defs"
+	"github.com/bluenviron/mediamtx/internal/servers/moq"
+	"github.com/bluenviron/mediamtx/internal/test"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+)
+
+type testMoQServer struct {
+	sessions map[uuid.UUID]*defs.APIMoQSession
+}
+
+func (s *testMoQServer) APISessionsList() (*defs.APIMoQSessionList, error) {
+	items := make([]defs.APIMoQSession, 0, len(s.sessions))
+	for _, session := range s.sessions {
+		items = append(items, *session)
+	}
+	return &defs.APIMoQSessionList{Items: items}, nil
+}
+
+func (s *testMoQServer) APISessionsGet(id uuid.UUID) (*defs.APIMoQSession, error) {
+	session, ok := s.sessions[id]
+	if !ok {
+		return nil, moq.ErrSessionNotFound
+	}
+	return session, nil
+}
+
+func (s *testMoQServer) APISessionsKick(id uuid.UUID) error {
+	_, ok := s.sessions[id]
+	if !ok {
+		return moq.ErrSessionNotFound
+	}
+	return nil
+}
+
+func TestMoQSessionsList(t *testing.T) {
+	id1 := uuid.New()
+	id2 := uuid.New()
+	now := time.Now()
+
+	moqServer := &testMoQServer{
+		sessions: map[uuid.UUID]*defs.APIMoQSession{
+			id1: {
+				ID:            id1,
+				Created:       now,
+				RemoteAddr:    "192.168.1.1:5000",
+				State:         defs.APIMoQSessionStatePublish,
+				Path:          "stream1",
+				Query:         "token=abc",
+				InboundBytes:  1000,
+				OutboundBytes: 2000,
+			},
+			id2: {
+				ID:            id2,
+				Created:       now.Add(time.Minute),
+				RemoteAddr:    "192.168.1.2:5001",
+				State:         defs.APIMoQSessionStateRead,
+				Path:          "stream2",
+				Query:         "",
+				InboundBytes:  500,
+				OutboundBytes: 1500,
+			},
+		},
+	}
+
+	api := API{
+		Address:      "localhost:9997",
+		ReadTimeout:  conf.Duration(10 * time.Second),
+		WriteTimeout: conf.Duration(10 * time.Second),
+		AuthManager:  test.NilAuthManager,
+		MoQServer:    moqServer,
+		Parent:       &testParent{},
+	}
+	err := api.Initialize()
+	require.NoError(t, err)
+	defer api.Close()
+
+	tr := &http.Transport{}
+	defer tr.CloseIdleConnections()
+	hc := &http.Client{Transport: tr}
+
+	var out defs.APIMoQSessionList
+	httpRequest(t, hc, http.MethodGet, "http://localhost:9997/v3/moqsessions/list", nil, &out)
+
+	require.Equal(t, 2, out.ItemCount)
+	require.Equal(t, 1, out.PageCount)
+	require.Len(t, out.Items, 2)
+}
+
+func TestMoQSessionsGet(t *testing.T) {
+	id := uuid.New()
+	now := time.Now()
+
+	moqServer := &testMoQServer{
+		sessions: map[uuid.UUID]*defs.APIMoQSession{
+			id: {
+				ID:            id,
+				Created:       now,
+				RemoteAddr:    "192.168.1.100:5000",
+				State:         defs.APIMoQSessionStatePublish,
+				Path:          "mystream",
+				Query:         "key=value",
+				InboundBytes:  999999,
+				OutboundBytes: 888888,
+			},
+		},
+	}
+
+	api := API{
+		Address:      "localhost:9997",
+		ReadTimeout:  conf.Duration(10 * time.Second),
+		WriteTimeout: conf.Duration(10 * time.Second),
+		AuthManager:  test.NilAuthManager,
+		MoQServer:    moqServer,
+		Parent:       &testParent{},
+	}
+	err := api.Initialize()
+	require.NoError(t, err)
+	defer api.Close()
+
+	tr := &http.Transport{}
+	defer tr.CloseIdleConnections()
+	hc := &http.Client{Transport: tr}
+
+	var out defs.APIMoQSession
+	httpRequest(t, hc, http.MethodGet, fmt.Sprintf("http://localhost:9997/v3/moqsessions/get/%s", id), nil, &out)
+
+	require.Equal(t, id, out.ID)
+	require.Equal(t, "192.168.1.100:5000", out.RemoteAddr)
+	require.Equal(t, defs.APIMoQSessionStatePublish, out.State)
+	require.Equal(t, "mystream", out.Path)
+	require.Equal(t, uint64(999999), out.InboundBytes)
+	require.Equal(t, uint64(888888), out.OutboundBytes)
+}
+
+func TestMoQSessionsKick(t *testing.T) {
+	id := uuid.New()
+	now := time.Now()
+
+	moqServer := &testMoQServer{
+		sessions: map[uuid.UUID]*defs.APIMoQSession{
+			id: {
+				ID:            id,
+				Created:       now,
+				RemoteAddr:    "192.168.1.100:5000",
+				State:         defs.APIMoQSessionStatePublish,
+				Path:          "mystream",
+				Query:         "",
+				InboundBytes:  1000,
+				OutboundBytes: 2000,
+			},
+		},
+	}
+
+	api := API{
+		Address:      "localhost:9997",
+		ReadTimeout:  conf.Duration(10 * time.Second),
+		WriteTimeout: conf.Duration(10 * time.Second),
+		AuthManager:  test.NilAuthManager,
+		MoQServer:    moqServer,
+		Parent:       &testParent{},
+	}
+	err := api.Initialize()
+	require.NoError(t, err)
+	defer api.Close()
+
+	tr := &http.Transport{}
+	defer tr.CloseIdleConnections()
+	hc := &http.Client{Transport: tr}
+
+	httpRequest(t, hc, http.MethodPost, fmt.Sprintf("http://localhost:9997/v3/moqsessions/kick/%s", id), nil, nil)
+}
diff --git a/internal/auth/request.go b/internal/auth/request.go
index 94e18969..fa149ebd 100644
--- a/internal/auth/request.go
+++ b/internal/auth/request.go
@@ -17,6 +17,7 @@ const (
 	ProtocolHLS    Protocol = "hls"
 	ProtocolWebRTC Protocol = "webrtc"
 	ProtocolSRT    Protocol = "srt"
+	ProtocolMoQ    Protocol = "moq"
 )
 
 // Request is an authentication request.
diff --git a/internal/certloader/certloader.go b/internal/certloader/certloader.go
index 5eba2c6f..9f3b7d51 100644
--- a/internal/certloader/certloader.go
+++ b/internal/certloader/certloader.go
@@ -2,18 +2,64 @@
 package certloader
 
 import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
 	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"fmt"
+	"math/big"
+	"os"
 	"sync"
+	"time"
 
 	"github.com/bluenviron/mediamtx/internal/confwatcher"
 	"github.com/bluenviron/mediamtx/internal/logger"
 )
 
+const (
+	autoKeyName  = "auto.key"
+	autoCertName = "auto.crt"
+)
+
+func generateTLSCert() (certPEM, keyPEM []byte, err error) {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return nil, nil, fmt.Errorf("generate key: %w", err)
+	}
+
+	template := x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: "mediamtx"},
+		NotBefore:    time.Now(),
+		NotAfter:     time.Now().Add(10 * 365 * 24 * time.Hour),
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+
+	certDER, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
+	if err != nil {
+		return nil, nil, fmt.Errorf("create certificate: %w", err)
+	}
+
+	keyDER, err := x509.MarshalECPrivateKey(key)
+	if err != nil {
+		return nil, nil, fmt.Errorf("marshal key: %w", err)
+	}
+
+	certPEM = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})
+	keyPEM = pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER})
+	return certPEM, keyPEM, nil
+}
+
 // CertLoader is a certificate loader. It watches for changes to the certificate and key files.
 type CertLoader struct {
-	CertPath string
-	KeyPath  string
-	Parent   logger.Writer
+	CertPath  string
+	KeyPath   string
+	AllowAuto bool
+	Parent    logger.Writer
 
 	certWatcher, keyWatcher *confwatcher.ConfWatcher
 	cert                    *tls.Certificate
@@ -26,38 +72,88 @@ type CertLoader struct {
 func (cl *CertLoader) Initialize() error {
 	cl.done = make(chan struct{})
 
+	if cl.AllowAuto && cl.KeyPath == autoKeyName && cl.CertPath == autoCertName {
+		watch, err := cl.initializeAuto()
+		if err != nil {
+			return err
+		}
+		if !watch {
+			return nil
+		}
+	} else {
+		cert, err := tls.LoadX509KeyPair(cl.CertPath, cl.KeyPath)
+		if err != nil {
+			return err
+		}
+		cl.certMu.Lock()
+		cl.cert = &cert
+		cl.certMu.Unlock()
+	}
+
 	cl.certWatcher = &confwatcher.ConfWatcher{FilePath: cl.CertPath}
-	err := cl.certWatcher.Initialize()
-	if err != nil {
+	if err := cl.certWatcher.Initialize(); err != nil {
 		return err
 	}
 
 	cl.keyWatcher = &confwatcher.ConfWatcher{FilePath: cl.KeyPath}
-	err = cl.keyWatcher.Initialize()
-	if err != nil {
+	if err := cl.keyWatcher.Initialize(); err != nil {
 		cl.certWatcher.Close() //nolint:errcheck
 		return err
 	}
 
-	cert, err := tls.LoadX509KeyPair(cl.CertPath, cl.KeyPath)
-	if err != nil {
-		return err
-	}
-
-	cl.certMu.Lock()
-	cl.cert = &cert
-	cl.certMu.Unlock()
-
 	go cl.watch()
 
 	return nil
 }
 
+func (cl *CertLoader) initializeAuto() (bool, error) {
+	_, keyErr := os.Stat(cl.KeyPath)
+	_, certErr := os.Stat(cl.CertPath)
+
+	if keyErr == nil && certErr == nil {
+		cert, err := tls.LoadX509KeyPair(cl.CertPath, cl.KeyPath)
+		if err != nil {
+			return false, err
+		}
+		cl.certMu.Lock()
+		cl.cert = &cert
+		cl.certMu.Unlock()
+		return true, nil
+	}
+
+	cl.Parent.Log(logger.Warn, "certificate %s not found, generating it from scratch", cl.KeyPath)
+
+	certPEM, keyPEM, err := generateTLSCert()
+	if err != nil {
+		return false, err
+	}
+
+	keyWriteErr := os.WriteFile(cl.KeyPath, keyPEM, 0o600)
+	if keyWriteErr != nil {
+		cl.Parent.Log(logger.Warn, "failed to save TLS key to %s: %v", cl.KeyPath, keyWriteErr)
+	}
+	certWriteErr := os.WriteFile(cl.CertPath, certPEM, 0o600)
+	if certWriteErr != nil {
+		cl.Parent.Log(logger.Warn, "failed to save TLS cert to %s: %v", cl.CertPath, certWriteErr)
+	}
+
+	cert, _ := tls.X509KeyPair(certPEM, keyPEM)
+	cl.certMu.Lock()
+	cl.cert = &cert
+	cl.certMu.Unlock()
+
+	return keyWriteErr == nil && certWriteErr == nil, nil
+}
+
 // Close closes a CertLoader and releases any underlying resources.
 func (cl *CertLoader) Close() {
 	close(cl.done)
-	cl.certWatcher.Close() //nolint:errcheck
-	cl.keyWatcher.Close()  //nolint:errcheck
+	if cl.certWatcher != nil {
+		cl.certWatcher.Close() //nolint:errcheck
+	}
+	if cl.keyWatcher != nil {
+		cl.keyWatcher.Close() //nolint:errcheck
+	}
 	cl.certMu.Lock()
 	defer cl.certMu.Unlock()
 	cl.cert = nil
@@ -87,6 +183,7 @@ func (cl *CertLoader) watch() {
 			cl.certMu.Unlock()
 
 			cl.Parent.Log(logger.Info, "certificate reloaded after change to %s", cl.CertPath)
+
 		case <-cl.keyWatcher.Watch():
 			cert, err := tls.LoadX509KeyPair(cl.CertPath, cl.KeyPath)
 			if err != nil {
@@ -99,6 +196,7 @@ func (cl *CertLoader) watch() {
 			cl.certMu.Unlock()
 
 			cl.Parent.Log(logger.Info, "certificate reloaded after change to %s", cl.KeyPath)
+
 		case <-cl.done:
 			return
 		}
diff --git a/internal/conf/conf.go b/internal/conf/conf.go
index 0c1f90f2..546cd19e 100644
--- a/internal/conf/conf.go
+++ b/internal/conf/conf.go
@@ -394,6 +394,15 @@ type Conf struct {
 	SRT        bool   `json:"srt"`
 	SRTAddress string `json:"srtAddress"`
 
+	// MoQ server
+	MoQ               bool       `json:"moq"`
+	MoQHTTPS2Address  string     `json:"moqHTTPS2Address"`
+	MoQHTTPS3Address  string     `json:"moqHTTPS3Address"`
+	MoQServerKey      string     `json:"moqServerKey"`
+	MoQServerCert     string     `json:"moqServerCert"`
+	MoQAllowOrigins   []string   `json:"moqAllowOrigins"`
+	MoQTrustedProxies IPNetworks `json:"moqTrustedProxies"`
+
 	// Record (deprecated)
 	Record                *bool         `json:"record,omitempty" deprecated:"true"`
 	RecordPath            *string       `json:"recordPath,omitempty" deprecated:"true"`
@@ -522,6 +531,14 @@ func (conf *Conf) setDefaults() {
 	conf.SRT = true
 	conf.SRTAddress = ":8890"
 
+	// MoQ server
+	conf.MoQ = true
+	conf.MoQHTTPS2Address = ":8892"
+	conf.MoQHTTPS3Address = ":8892"
+	conf.MoQServerKey = "auto.key"
+	conf.MoQServerCert = "auto.crt"
+	conf.MoQAllowOrigins = []string{"*"}
+
 	conf.PathDefaults.setDefaults()
 }
 
diff --git a/internal/core/api_test.go b/internal/core/api_test.go
index 8a8c2d75..2f45529a 100644
--- a/internal/core/api_test.go
+++ b/internal/core/api_test.go
@@ -875,14 +875,14 @@ func TestAPIProtocolListGet(t *testing.T) {
 							"bytesAvailReceiveBuf":          float64(0),
 							"bytesAvailSendBuf":             float64(0),
 							"bytesReceiveBuf":               float64(0),
-							"bytesReceived":                 float64(628),
+							"bytesReceived":                 out1.(map[string]any)["items"].([]any)[0].(map[string]any)["bytesReceived"],
 							"bytesReceivedBelated":          float64(0),
 							"bytesReceivedDrop":             float64(0),
 							"bytesReceivedLoss":             float64(0),
 							"bytesReceivedRetrans":          float64(0),
 							"bytesReceivedUndecrypt":        float64(0),
 							"outboundFramesDiscarded":       out1.(map[string]any)["items"].([]any)[0].(map[string]any)["outboundFramesDiscarded"],
-							"bytesReceivedUnique":           float64(628),
+							"bytesReceivedUnique":           out1.(map[string]any)["items"].([]any)[0].(map[string]any)["bytesReceivedUnique"],
 							"bytesRetrans":                  float64(0),
 							"bytesSendBuf":                  float64(0),
 							"bytesSendDrop":                 float64(0),
@@ -1001,6 +1001,13 @@ func TestAPIProtocolListGet(t *testing.T) {
 
 			case "hls muxers":
 				out2.(map[string]any)["lastRequest"] = out1.(map[string]any)["items"].([]any)[0].(map[string]any)["lastRequest"]
+
+			case "srt":
+				out2.(map[string]any)["bytesReceived"] = out1.(map[string]any)["items"].([]any)[0].(map[string]any)["bytesReceived"]
+				out2.(map[string]any)["bytesReceivedUnique"] = out1.(map[string]any)["items"].([]any)[0].(map[string]any)["bytesReceivedUnique"]
+				out2.(map[string]any)["packetsReceivedACK"] = out1.(map[string]any)["items"].([]any)[0].(map[string]any)["packetsReceivedACK"]
+				out2.(map[string]any)["packetsSentACK"] = out1.(map[string]any)["items"].([]any)[0].(map[string]any)["packetsSentACK"]
+				out2.(map[string]any)["msRTT"] = out1.(map[string]any)["items"].([]any)[0].(map[string]any)["msRTT"]
 			}
 
 			require.Equal(t, out1.(map[string]any)["items"].([]any)[0], out2)
diff --git a/internal/core/core.go b/internal/core/core.go
index 3ef2b741..536eab1a 100644
--- a/internal/core/core.go
+++ b/internal/core/core.go
@@ -31,6 +31,7 @@ import (
 	"github.com/bluenviron/mediamtx/internal/recordcleaner"
 	"github.com/bluenviron/mediamtx/internal/rlimit"
 	"github.com/bluenviron/mediamtx/internal/servers/hls"
+	"github.com/bluenviron/mediamtx/internal/servers/moq"
 	"github.com/bluenviron/mediamtx/internal/servers/rtmp"
 	"github.com/bluenviron/mediamtx/internal/servers/rtsp"
 	"github.com/bluenviron/mediamtx/internal/servers/srt"
@@ -125,6 +126,7 @@ type Core struct {
 	hlsServer       *hls.Server
 	webRTCServer    *webrtc.Server
 	srtServer       *srt.Server
+	moqServer       *moq.Server
 	api             *api.API
 	confWatcher     *confwatcher.ConfWatcher
 
@@ -694,6 +696,29 @@ func (p *Core) createResources(initial bool) error {
 		p.srtServer = i
 	}
 
+	if p.conf.MoQ &&
+		p.moqServer == nil {
+		i := &moq.Server{
+			HTTPS2Address:     p.conf.MoQHTTPS2Address,
+			HTTPS3Address:     p.conf.MoQHTTPS3Address,
+			ServerKey:         p.conf.MoQServerKey,
+			ServerCert:        p.conf.MoQServerCert,
+			AllowOrigins:      p.conf.MoQAllowOrigins,
+			TrustedProxies:    p.conf.MoQTrustedProxies,
+			UDPReadBufferSize: p.conf.UDPReadBufferSize,
+			ReadTimeout:       p.conf.ReadTimeout,
+			WriteTimeout:      p.conf.WriteTimeout,
+			PathManager:       p.pathManager,
+			Metrics:           p.metrics,
+			Parent:            p,
+		}
+		err = i.Initialize()
+		if err != nil {
+			return err
+		}
+		p.moqServer = i
+	}
+
 	if p.conf.API &&
 		p.api == nil {
 		i := &api.API{
@@ -718,6 +743,7 @@ func (p *Core) createResources(initial bool) error {
 			HLSServer:      p.hlsServer,
 			WebRTCServer:   p.webRTCServer,
 			SRTServer:      p.srtServer,
+			MoQServer:      p.moqServer,
 			Parent:         p,
 		}
 		err = i.Initialize()
@@ -974,6 +1000,21 @@ func (p *Core) closeResources(newConf *conf.Conf, calledByAPI bool) {
 		closePathManager ||
 		closeLogger
 
+	closeMoQServer := newConf == nil ||
+		newConf.MoQ != p.conf.MoQ ||
+		newConf.MoQHTTPS2Address != p.conf.MoQHTTPS2Address ||
+		newConf.MoQHTTPS3Address != p.conf.MoQHTTPS3Address ||
+		newConf.MoQServerKey != p.conf.MoQServerKey ||
+		newConf.MoQServerCert != p.conf.MoQServerCert ||
+		!slices.Equal(newConf.MoQAllowOrigins, p.conf.MoQAllowOrigins) ||
+		!reflect.DeepEqual(newConf.MoQTrustedProxies, p.conf.MoQTrustedProxies) ||
+		newConf.UDPReadBufferSize != p.conf.UDPReadBufferSize ||
+		newConf.ReadTimeout != p.conf.ReadTimeout ||
+		newConf.WriteTimeout != p.conf.WriteTimeout ||
+		closeMetrics ||
+		closePathManager ||
+		closeLogger
+
 	closeAPI := newConf == nil ||
 		newConf.API != p.conf.API ||
 		newConf.APIAddress != p.conf.APIAddress ||
@@ -994,6 +1035,7 @@ func (p *Core) closeResources(newConf *conf.Conf, calledByAPI bool) {
 		closeHLSServer ||
 		closeWebRTCServer ||
 		closeSRTServer ||
+		closeMoQServer ||
 		closeLogger
 
 	if newConf == nil && p.confWatcher != nil {
@@ -1015,6 +1057,11 @@ func (p *Core) closeResources(newConf *conf.Conf, calledByAPI bool) {
 		p.srtServer = nil
 	}
 
+	if closeMoQServer && p.moqServer != nil {
+		p.moqServer.Close()
+		p.moqServer = nil
+	}
+
 	if closeWebRTCServer && p.webRTCServer != nil {
 		p.webRTCServer.Close()
 		p.webRTCServer = nil
diff --git a/internal/core/metrics_test.go b/internal/core/metrics_test.go
index 4c80b75e..2951e446 100644
--- a/internal/core/metrics_test.go
+++ b/internal/core/metrics_test.go
@@ -263,6 +263,11 @@ webrtc_sessions_rtp_packets_jitter 0
 webrtc_sessions_rtcp_packets_received 0
 webrtc_sessions_rtcp_packets_sent 0
 
+# MoQ sessions
+moq_sessions 0
+moq_sessions_inbound_bytes 0
+moq_sessions_outbound_bytes 0
+
 `, string(bo))
 	})
 
@@ -497,6 +502,11 @@ webrtc_sessions_rtcp_packets_sent 0
 			"paths_bytes_received 0\n"+
 			"paths_bytes_sent 0\n"+
 			"paths_readers 0\n"+
+			"\n"+
+			"# MoQ sessions\n"+
+			"moq_sessions 0\n"+
+			"moq_sessions_inbound_bytes 0\n"+
+			"moq_sessions_outbound_bytes 0\n"+
 			"\n",
 			string(bo))
 	})
diff --git a/internal/core/path_manager.go b/internal/core/path_manager.go
index fcb9386f..dbd29d5e 100644
--- a/internal/core/path_manager.go
+++ b/internal/core/path_manager.go
@@ -345,10 +345,12 @@ func (pm *pathManager) doDescribe(req defs.PathDescribeReq) {
 		return
 	}
 
-	_, err2 := pm.authManager.Authenticate(req.AccessRequest.ToAuthRequest())
-	if err2 != nil {
-		req.Res <- defs.PathDescribeRes{Err: err2}
-		return
+	if !req.AccessRequest.SkipAuth {
+		_, err2 := pm.authManager.Authenticate(req.AccessRequest.ToAuthRequest())
+		if err2 != nil {
+			req.Res <- defs.PathDescribeRes{Err: err2}
+			return
+		}
 	}
 
 	// create path if it doesn't exist
diff --git a/internal/defs/api_moq.go b/internal/defs/api_moq.go
new file mode 100644
index 00000000..772269ed
--- /dev/null
+++ b/internal/defs/api_moq.go
@@ -0,0 +1,44 @@
+package defs
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// APIMoQServer contains methods used by the API server.
+type APIMoQServer interface {
+	APISessionsList() (*APIMoQSessionList, error)
+	APISessionsGet(uuid.UUID) (*APIMoQSession, error)
+	APISessionsKick(uuid.UUID) error
+}
+
+// APIMoQSessionState is the state of a MoQ session.
+type APIMoQSessionState string
+
+// states.
+const (
+	APIMoQSessionStateIdle    APIMoQSessionState = "idle"
+	APIMoQSessionStateRead    APIMoQSessionState = "read"
+	APIMoQSessionStatePublish APIMoQSessionState = "publish"
+)
+
+// APIMoQSessionList is a list of MoQ sessions.
+type APIMoQSessionList struct {
+	ItemCount int             `json:"itemCount"`
+	PageCount int             `json:"pageCount"`
+	Items     []APIMoQSession `json:"items"`
+}
+
+// APIMoQSession is a MoQ session.
+type APIMoQSession struct {
+	ID            uuid.UUID          `json:"id"`
+	Created       time.Time          `json:"created"`
+	RemoteAddr    string             `json:"remoteAddr"`
+	State         APIMoQSessionState `json:"state"`
+	Path          string             `json:"path"`
+	Query         string             `json:"query"`
+	UserAgent     string             `json:"userAgent"`
+	InboundBytes  uint64             `json:"inboundBytes"`
+	OutboundBytes uint64             `json:"outboundBytes"`
+}
diff --git a/internal/defs/api_path.go b/internal/defs/api_path.go
index c3e0ccb0..74c747b4 100644
--- a/internal/defs/api_path.go
+++ b/internal/defs/api_path.go
@@ -30,6 +30,7 @@ const (
 	APIPathSourceTypeRTPSource       APIPathSourceType = "rtpSource"
 	APIPathSourceTypeWebRTCSession   APIPathSourceType = "webRTCSession"
 	APIPathSourceTypeWebRTCSource    APIPathSourceType = "webRTCSource"
+	APIPathSourceTypeMoQSession      APIPathSourceType = "moqSession"
 )
 
 // APIPathSource is a source.
@@ -52,6 +53,7 @@ const (
 	APIPathReaderTypeRTSPSSession  APIPathReaderType = "rtspsSession"
 	APIPathReaderTypeSRTConn       APIPathReaderType = "srtConn"
 	APIPathReaderTypeWebRTCSession APIPathReaderType = "webRTCSession"
+	APIPathReaderTypeMoQSession    APIPathReaderType = "moqSession"
 	APIPathReaderTypeHidden        APIPathReaderType = "hidden"
 )
 
diff --git a/internal/defs/path_access_request.go b/internal/defs/path_access_request.go
index f22dd9fb..11b67e7b 100644
--- a/internal/defs/path_access_request.go
+++ b/internal/defs/path_access_request.go
@@ -12,9 +12,9 @@ import (
 type PathAccessRequest struct {
 	Name      string
 	Query     string
+	UserAgent string
 	Publish   bool
 	SkipAuth  bool
-	UserAgent string
 
 	// only if skipAuth = false
 	Proto            auth.Protocol
diff --git a/internal/metrics/metrics.go b/internal/metrics/metrics.go
index ac63cde5..ea9e44de 100644
--- a/internal/metrics/metrics.go
+++ b/internal/metrics/metrics.go
@@ -84,6 +84,7 @@ const (
 	metricsTypeRTMPSConns     metricsType = "rtmps_conns"
 	metricsTypeSRTConns       metricsType = "srt_conns"
 	metricsTypeWebRTCSessions metricsType = "webrtc_sessions"
+	metricsTypeMoQSessions    metricsType = "moq_sessions"
 )
 
 type metricsAuthManager interface {
@@ -118,13 +119,13 @@ type Metrics struct {
 	rtmpsServer  defs.APIRTMPServer
 	srtServer    defs.APISRTServer
 	webRTCServer defs.APIWebRTCServer
+	moqServer    defs.APIMoQServer
 }
 
 // Initialize initializes metrics.
 func (m *Metrics) Initialize() error {
 	router := gin.New()
 	router.SetTrustedProxies(m.TrustedProxies.ToTrustedProxies()) //nolint:errcheck
-
 	router.Use(m.middlewarePreflightRequests)
 	router.Use(m.middlewareAuth)
 
@@ -148,7 +149,7 @@ func (m *Metrics) Initialize() error {
 		return err
 	}
 
-	str := "listener opened on " + m.Address
+	str := "started with listener on " + m.Address
 	if !m.Encryption {
 		str += " (TCP/HTTP)"
 	} else {
@@ -161,7 +162,7 @@ func (m *Metrics) Initialize() error {
 
 // Close closes Metrics.
 func (m *Metrics) Close() {
-	m.Log(logger.Info, "listener is closing")
+	m.Log(logger.Info, "closing")
 	m.httpServer.Close()
 }
 
@@ -223,6 +224,7 @@ func (m *Metrics) onMetrics(ctx *gin.Context) {
 	rtmpsServer := m.rtmpsServer
 	srtServer := m.srtServer
 	webRTCServer := m.webRTCServer
+	moqServer := m.moqServer
 	m.mutex.RUnlock()
 
 	typ := metricsType(ctx.Query("type"))
@@ -237,6 +239,7 @@ func (m *Metrics) onMetrics(ctx *gin.Context) {
 	rtmpsConnFilter := ctx.Query("rtmps_conn")
 	srtConnFilter := ctx.Query("srt_conn")
 	webrtcSessionFilter := ctx.Query("webrtc_session")
+	moqSessionFilter := ctx.Query("moq_session")
 
 	anyFilterActive := pathFilter != "" ||
 		hlsMuxerFilter != "" ||
@@ -248,7 +251,8 @@ func (m *Metrics) onMetrics(ctx *gin.Context) {
 		rtmpConnFilter != "" ||
 		rtmpsConnFilter != "" ||
 		srtConnFilter != "" ||
-		webrtcSessionFilter != ""
+		webrtcSessionFilter != "" ||
+		moqSessionFilter != ""
 
 	var out strings.Builder
 
@@ -993,6 +997,37 @@ func (m *Metrics) onMetrics(ctx *gin.Context) {
 		}
 	}
 
+	if !interfaceIsEmpty(moqServer) &&
+		(typ == "" || typ == metricsTypeMoQSessions) &&
+		(!anyFilterActive || moqSessionFilter != "") {
+		var data *defs.APIMoQSessionList
+		data, err := moqServer.APISessionsList()
+		if err == nil && len(data.Items) != 0 {
+			out.WriteString("# MoQ sessions\n")
+			for _, i := range data.Items {
+				if moqSessionFilter == "" || moqSessionFilter == i.ID.String() {
+					ta := tags(map[string]string{
+						"id":         i.ID.String(),
+						"state":      string(i.State),
+						"path":       i.Path,
+						"remoteAddr": i.RemoteAddr,
+					})
+
+					metric(&out, "moq_sessions", ta, 1)
+					metric(&out, "moq_sessions_inbound_bytes", ta, int64(i.InboundBytes))
+					metric(&out, "moq_sessions_outbound_bytes", ta, int64(i.OutboundBytes))
+				}
+			}
+			out.WriteString("\n")
+		} else if moqSessionFilter == "" {
+			out.WriteString("# MoQ sessions\n")
+			metric(&out, "moq_sessions", "", 0)
+			metric(&out, "moq_sessions_inbound_bytes", "", 0)
+			metric(&out, "moq_sessions_outbound_bytes", "", 0)
+			out.WriteString("\n")
+		}
+	}
+
 	ctx.Writer.WriteHeader(http.StatusOK)
 	ctx.Writer.WriteString(out.String()) //nolint:errcheck
 }
@@ -1052,3 +1087,10 @@ func (m *Metrics) SetWebRTCServer(s defs.APIWebRTCServer) {
 	defer m.mutex.Unlock()
 	m.webRTCServer = s
 }
+
+// SetMoQServer is called by core.
+func (m *Metrics) SetMoQServer(s defs.APIMoQServer) {
+	m.mutex.Lock()
+	defer m.mutex.Unlock()
+	m.moqServer = s
+}
diff --git a/internal/metrics/metrics_test.go b/internal/metrics/metrics_test.go
index b4c62947..ed6f51d0 100644
--- a/internal/metrics/metrics_test.go
+++ b/internal/metrics/metrics_test.go
@@ -328,6 +328,32 @@ func (dummyWebRTCServer) APISessionsKick(uuid.UUID) error {
 	panic("unused")
 }
 
+type dummyMoQServer struct{}
+
+func (dummyMoQServer) APISessionsList() (*defs.APIMoQSessionList, error) {
+	return &defs.APIMoQSessionList{
+		ItemCount: 1,
+		PageCount: 1,
+		Items: []defs.APIMoQSession{{
+			ID:            uuid.MustParse("b47ac10b-58cc-4372-a567-0e02b2c3d479"),
+			Created:       time.Date(2003, 11, 4, 23, 15, 7, 0, time.UTC),
+			RemoteAddr:    "127.0.0.2:3456",
+			State:         defs.APIMoQSessionStatePublish,
+			Path:          "mypath",
+			InboundBytes:  321,
+			OutboundBytes: 654,
+		}},
+	}, nil
+}
+
+func (dummyMoQServer) APISessionsGet(uuid.UUID) (*defs.APIMoQSession, error) {
+	panic("unused")
+}
+
+func (dummyMoQServer) APISessionsKick(uuid.UUID) error {
+	panic("unused")
+}
+
 type emptyPathManager struct{}
 
 func (emptyPathManager) APIPathsList() (*defs.APIPathList, error) {
@@ -410,6 +436,20 @@ func (emptyWebRTCServer) APISessionsKick(uuid.UUID) error {
 	panic("unused")
 }
 
+type emptyMoQServer struct{}
+
+func (emptyMoQServer) APISessionsList() (*defs.APIMoQSessionList, error) {
+	return &defs.APIMoQSessionList{}, nil
+}
+
+func (emptyMoQServer) APISessionsGet(uuid.UUID) (*defs.APIMoQSession, error) {
+	panic("unused")
+}
+
+func (emptyMoQServer) APISessionsKick(uuid.UUID) error {
+	panic("unused")
+}
+
 func TestPreflightRequest(t *testing.T) {
 	m := Metrics{
 		Address:      "localhost:9998",
@@ -479,6 +519,7 @@ func TestMetrics(t *testing.T) {
 	m.SetRTMPSServer(&dummyRTMPServer{})
 	m.SetSRTServer(&dummySRTServer{})
 	m.SetWebRTCServer(&dummyWebRTCServer{})
+	m.SetMoQServer(&dummyMoQServer{})
 
 	tr := &http.Transport{}
 	defer tr.CloseIdleConnections()
@@ -821,6 +862,14 @@ func TestMetrics(t *testing.T) {
 			"remoteAddr=\"127.0.0.1:3455\",state=\"read\"} 123\n"+
 			"webrtc_sessions_rtcp_packets_sent{id=\"f47ac10b-58cc-4372-a567-0e02b2c3d479\",path=\"mypath\","+
 			"remoteAddr=\"127.0.0.1:3455\",state=\"read\"} 456\n"+
+			"\n"+
+			"# MoQ sessions\n"+
+			"moq_sessions{id=\"b47ac10b-58cc-4372-a567-0e02b2c3d479\",path=\"mypath\","+
+			"remoteAddr=\"127.0.0.2:3456\",state=\"publish\"} 1\n"+
+			"moq_sessions_inbound_bytes{id=\"b47ac10b-58cc-4372-a567-0e02b2c3d479\",path=\"mypath\","+
+			"remoteAddr=\"127.0.0.2:3456\",state=\"publish\"} 321\n"+
+			"moq_sessions_outbound_bytes{id=\"b47ac10b-58cc-4372-a567-0e02b2c3d479\",path=\"mypath\","+
+			"remoteAddr=\"127.0.0.2:3456\",state=\"publish\"} 654\n"+
 			"\n",
 		string(byts))
 
@@ -845,6 +894,7 @@ func TestZeroMetricsFallback(t *testing.T) {
 	m.SetRTSPServer(&emptyRTSPServer{})
 	m.SetSRTServer(&emptySRTServer{})
 	m.SetWebRTCServer(&emptyWebRTCServer{})
+	m.SetMoQServer(&emptyMoQServer{})
 
 	tr := &http.Transport{}
 	defer tr.CloseIdleConnections()
@@ -995,6 +1045,11 @@ func TestZeroMetricsFallback(t *testing.T) {
 			"webrtc_sessions_rtp_packets_jitter 0\n"+
 			"webrtc_sessions_rtcp_packets_received 0\n"+
 			"webrtc_sessions_rtcp_packets_sent 0\n"+
+			"\n"+
+			"# MoQ sessions\n"+
+			"moq_sessions 0\n"+
+			"moq_sessions_inbound_bytes 0\n"+
+			"moq_sessions_outbound_bytes 0\n"+
 			"\n",
 		string(byts))
 }
@@ -1012,6 +1067,7 @@ func TestFilter(t *testing.T) {
 		"rtmps_conn",
 		"srt_conn",
 		"webrtc_session",
+		"moq_session",
 	} {
 		t.Run(ca, func(t *testing.T) {
 			m := Metrics{
@@ -1034,6 +1090,7 @@ func TestFilter(t *testing.T) {
 			m.SetRTMPSServer(&dummyRTMPServer{})
 			m.SetSRTServer(&dummySRTServer{})
 			m.SetWebRTCServer(&dummyWebRTCServer{})
+			m.SetMoQServer(&dummyMoQServer{})
 
 			tr := &http.Transport{}
 			defer tr.CloseIdleConnections()
@@ -1064,6 +1121,8 @@ func TestFilter(t *testing.T) {
 				u += "?srt_conn=a0b1c2d3-e4f5-6789-abcd-ef0123456789"
 			case "webrtc_session":
 				u += "?webrtc_session=f47ac10b-58cc-4372-a567-0e02b2c3d479"
+			case "moq_session":
+				u += "?moq_session=b47ac10b-58cc-4372-a567-0e02b2c3d479"
 			}
 
 			res, err := hc.Get(u)
@@ -1435,6 +1494,17 @@ func TestFilter(t *testing.T) {
 						`webrtc_sessions_rtcp_packets_sent{id="f47ac10b-58cc-4372-a567-0e02b2c3d479",`+
 						`path="mypath",remoteAddr="127.0.0.1:3455",state="read"} 456`+"\n\n",
 					string(byts))
+
+			case "moq_session":
+				require.Equal(t,
+					"# MoQ sessions\n"+
+						`moq_sessions{id="b47ac10b-58cc-4372-a567-0e02b2c3d479",`+
+						`path="mypath",remoteAddr="127.0.0.2:3456",state="publish"} 1`+"\n"+
+						`moq_sessions_inbound_bytes{id="b47ac10b-58cc-4372-a567-0e02b2c3d479",`+
+						`path="mypath",remoteAddr="127.0.0.2:3456",state="publish"} 321`+"\n"+
+						`moq_sessions_outbound_bytes{id="b47ac10b-58cc-4372-a567-0e02b2c3d479",`+
+						`path="mypath",remoteAddr="127.0.0.2:3456",state="publish"} 654`+"\n\n",
+					string(byts))
 			}
 		})
 	}
@@ -1463,6 +1533,7 @@ func TestFilterByType(t *testing.T) {
 			m.SetRTMPSServer(&dummyRTMPServer{})
 			m.SetSRTServer(&dummySRTServer{})
 			m.SetWebRTCServer(&dummyWebRTCServer{})
+			m.SetMoQServer(&dummyMoQServer{})
 
 			tr := &http.Transport{}
 			defer tr.CloseIdleConnections()
@@ -1661,6 +1732,7 @@ func TestMetricsConcurrentSettersAndReads(t *testing.T) {
 	m.SetRTMPSServer(&dummyRTMPServer{})
 	m.SetSRTServer(&dummySRTServer{})
 	m.SetWebRTCServer(&dummyWebRTCServer{})
+	m.SetMoQServer(&dummyMoQServer{})
 
 	tr := &http.Transport{}
 	defer tr.CloseIdleConnections()
@@ -1688,6 +1760,7 @@ func TestMetricsConcurrentSettersAndReads(t *testing.T) {
 		m.SetRTMPSServer(&dummyRTMPServer{})
 		m.SetSRTServer(&dummySRTServer{})
 		m.SetWebRTCServer(&dummyWebRTCServer{})
+		m.SetMoQServer(&dummyMoQServer{})
 
 		m.SetHLSServer(nil)
 		m.SetRTSPServer(nil)
@@ -1696,6 +1769,7 @@ func TestMetricsConcurrentSettersAndReads(t *testing.T) {
 		m.SetRTMPSServer(nil)
 		m.SetSRTServer(nil)
 		m.SetWebRTCServer(nil)
+		m.SetMoQServer(nil)
 	}
 
 	readers.Wait()
@@ -1752,6 +1826,7 @@ func BenchmarkFullMetricsHandler(b *testing.B) {
 	m.SetRTMPSServer(&dummyRTMPServer{})
 	m.SetSRTServer(&dummySRTServer{})
 	m.SetWebRTCServer(&dummyWebRTCServer{})
+	m.SetMoQServer(&dummyMoQServer{})
 
 	tr := &http.Transport{}
 	defer tr.CloseIdleConnections()
diff --git a/internal/playback/server.go b/internal/playback/server.go
index de26ba6d..061fa051 100644
--- a/internal/playback/server.go
+++ b/internal/playback/server.go
@@ -43,7 +43,6 @@ type Server struct {
 func (s *Server) Initialize() error {
 	router := gin.New()
 	router.SetTrustedProxies(s.TrustedProxies.ToTrustedProxies()) //nolint:errcheck
-
 	router.Use(s.middlewarePreflightRequests)
 
 	router.GET("/list", s.onList)
@@ -67,7 +66,7 @@ func (s *Server) Initialize() error {
 		return err
 	}
 
-	str := "listener opened on " + s.Address
+	str := "started with listener on " + s.Address
 	if !s.Encryption {
 		str += " (TCP/HTTP)"
 	} else {
@@ -80,7 +79,7 @@ func (s *Server) Initialize() error {
 
 // Close closes Server.
 func (s *Server) Close() {
-	s.Log(logger.Info, "listener is closing")
+	s.Log(logger.Info, "closing")
 	s.httpServer.Close()
 }
 
diff --git a/internal/pprof/pprof.go b/internal/pprof/pprof.go
index 4b6d3275..41a9c732 100644
--- a/internal/pprof/pprof.go
+++ b/internal/pprof/pprof.go
@@ -46,7 +46,6 @@ type PPROF struct {
 func (pp *PPROF) Initialize() error {
 	router := gin.New()
 	router.SetTrustedProxies(pp.TrustedProxies.ToTrustedProxies()) //nolint:errcheck
-
 	router.Use(pp.middlewarePreflightRequests)
 	router.Use(pp.middlewareAuth)
 
@@ -70,7 +69,7 @@ func (pp *PPROF) Initialize() error {
 		return err
 	}
 
-	str := "listener opened on " + pp.Address
+	str := "started with listener on " + pp.Address
 	if !pp.Encryption {
 		str += " (TCP/HTTP)"
 	} else {
@@ -83,7 +82,7 @@ func (pp *PPROF) Initialize() error {
 
 // Close closes PPROF.
 func (pp *PPROF) Close() {
-	pp.Log(logger.Info, "listener is closing")
+	pp.Log(logger.Info, "closing")
 	pp.httpServer.Close()
 }
 
diff --git a/internal/protocols/httpp/server.go b/internal/protocols/httpp/server.go
index 32e91cb2..80af81e7 100644
--- a/internal/protocols/httpp/server.go
+++ b/internal/protocols/httpp/server.go
@@ -25,8 +25,8 @@ func (nilWriter) Write(p []byte) (int, error) {
 }
 
 // Server is a wrapper around http.Server that provides:
-// - net.Listener allocation and closure
-// - TLS allocation
+// - net.Listener creation and destruction
+// - TLS initialization and hot reload
 // - exit on panic
 // - logging
 // - server header
@@ -41,6 +41,7 @@ type Server struct {
 	Encryption        bool
 	ServerCert        string
 	ServerKey         string
+	AllowAutoCert     bool
 	Handler           http.Handler
 	Parent            logger.Writer
 
@@ -67,9 +68,10 @@ func (s *Server) Initialize() error {
 		}
 
 		s.loader = &certloader.CertLoader{
-			CertPath: s.ServerCert,
-			KeyPath:  s.ServerKey,
-			Parent:   s.Parent,
+			CertPath:  s.ServerCert,
+			KeyPath:   s.ServerKey,
+			AllowAuto: s.AllowAutoCert,
+			Parent:    s.Parent,
 		}
 		err := s.loader.Initialize()
 		if err != nil {
@@ -121,6 +123,9 @@ func (s *Server) Initialize() error {
 	if tlsConfig != nil {
 		err := http2.ConfigureServer(s.inner, &http2.Server{})
 		if err != nil {
+			if s.loader != nil {
+				s.loader.Close()
+			}
 			return err
 		}
 	}
@@ -145,12 +150,18 @@ func (s *Server) Initialize() error {
 		var err error
 		s.ln, err = tlsListen(network, address, tlsConfig)
 		if err != nil {
+			if s.loader != nil {
+				s.loader.Close()
+			}
 			return err
 		}
 	} else {
 		var err error
 		s.ln, err = listen(network, address)
 		if err != nil {
+			if s.loader != nil {
+				s.loader.Close()
+			}
 			return err
 		}
 	}
diff --git a/internal/protocols/httpp3/server.go b/internal/protocols/httpp3/server.go
new file mode 100644
index 00000000..46961675
--- /dev/null
+++ b/internal/protocols/httpp3/server.go
@@ -0,0 +1,197 @@
+// Package httpp3 contains HTTP/3 utilities.
+package httpp3
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"fmt"
+	"math/big"
+	"net"
+	"net/http"
+	"os"
+	"sync"
+	"time"
+
+	"github.com/bluenviron/gortsplib/v5/pkg/readbuffer"
+	"github.com/bluenviron/mediamtx/internal/logger"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/quic-go/webtransport-go"
+)
+
+const (
+	// WebTransport requires certificates valid for at most 14 days.
+	certValidity = 14 * 24 * time.Hour
+	certRotation = 13 * 24 * time.Hour
+)
+
+func generateWebTransportCert() (*tls.Certificate, error) {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return nil, fmt.Errorf("generate key: %w", err)
+	}
+
+	serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
+	if err != nil {
+		return nil, fmt.Errorf("generate serial: %w", err)
+	}
+
+	now := time.Now()
+	template := x509.Certificate{
+		SerialNumber: serial,
+		Subject:      pkix.Name{CommonName: "mediamtx"},
+		NotBefore:    now,
+		NotAfter:     now.Add(certValidity),
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+
+	certDER, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
+	if err != nil {
+		return nil, fmt.Errorf("create certificate: %w", err)
+	}
+
+	keyDER, err := x509.MarshalECPrivateKey(key)
+	if err != nil {
+		return nil, fmt.Errorf("marshal key: %w", err)
+	}
+
+	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})
+	keyPEM := pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER})
+
+	cert, err := tls.X509KeyPair(certPEM, keyPEM)
+	if err != nil {
+		return nil, fmt.Errorf("parse certificate: %w", err)
+	}
+
+	return &cert, nil
+}
+
+// Server is a wrapper around http3.Server that provides:
+// - net.PacketConn creation and destruction
+// - JIT TLS certificate generation and rotation (WebTransport-compatible: ECDSA P-256, 14-day validity)
+type Server struct {
+	Address            string
+	UDPReadBufferSize  uint
+	EnableWebTransport bool
+	Handler            http.Handler
+	Parent             logger.Writer
+
+	ln        net.PacketConn
+	inner     *http3.Server
+	wtServer  *webtransport.Server
+	cert      *tls.Certificate
+	certMu    sync.RWMutex
+	terminate chan struct{}
+}
+
+// Initialize initializes a Server.
+func (s *Server) Initialize() error {
+	os.Setenv("QUIC_GO_DISABLE_RECEIVE_BUFFER_WARNING", "true") //nolint:errcheck
+
+	s.terminate = make(chan struct{})
+
+	var err error
+	s.ln, err = net.ListenPacket("udp", s.Address)
+	if err != nil {
+		return err
+	}
+
+	if s.UDPReadBufferSize != 0 {
+		err = readbuffer.SetReadBuffer(s.ln.(*net.UDPConn), int(s.UDPReadBufferSize))
+		if err != nil {
+			s.ln.Close()
+			return err
+		}
+	}
+
+	cert, err := generateWebTransportCert()
+	if err != nil {
+		return err
+	}
+	s.cert = cert
+
+	tlsConfig := &tls.Config{
+		GetCertificate: func(_ *tls.ClientHelloInfo) (*tls.Certificate, error) {
+			s.certMu.RLock()
+			defer s.certMu.RUnlock()
+			return s.cert, nil
+		},
+	}
+
+	s.inner = &http3.Server{
+		Handler:   s.Handler,
+		TLSConfig: tlsConfig,
+	}
+
+	if s.EnableWebTransport {
+		// webtransport.Server.Serve calls quic.ListenEarly directly with s.H3.TLSConfig,
+		// bypassing the http3.ConfigureTLSConfig call that http3.Server.Serve does internally.
+		// Pre-configure to set NextProtos = ["h3"] so QUIC ALPN negotiation succeeds.
+		s.inner.TLSConfig = http3.ConfigureTLSConfig(tlsConfig)
+		webtransport.ConfigureHTTP3Server(s.inner)
+		s.wtServer = &webtransport.Server{
+			H3:          s.inner,
+			CheckOrigin: func(_ *http.Request) bool { return true },
+		}
+		go s.wtServer.Serve(s.ln) //nolint:errcheck
+	} else {
+		go s.inner.Serve(s.ln) //nolint:errcheck
+	}
+
+	go s.rotateCert()
+
+	return nil
+}
+
+func (s *Server) rotateCert() {
+	t := time.NewTimer(certRotation)
+	defer t.Stop()
+
+	for {
+		select {
+		case <-t.C:
+			cert, err := generateWebTransportCert()
+			if err != nil {
+				s.Parent.Log(logger.Error, "failed to rotate WebTransport certificate: %v", err)
+			} else {
+				s.certMu.Lock()
+				s.cert = cert
+				s.certMu.Unlock()
+				s.Parent.Log(logger.Info, "WebTransport certificate rotated")
+			}
+			t.Reset(certRotation)
+
+		case <-s.terminate:
+			return
+		}
+	}
+}
+
+// Close closes all resources and waits for all routines to return.
+func (s *Server) Close() {
+	close(s.terminate)
+	s.ln.Close()
+	if s.wtServer != nil {
+		s.wtServer.Close() //nolint:errcheck
+	} else {
+		s.inner.Close() //nolint:errcheck
+	}
+}
+
+// Certificate returns the current TLS certificate.
+func (s *Server) Certificate() *tls.Certificate {
+	s.certMu.RLock()
+	defer s.certMu.RUnlock()
+	return s.cert
+}
+
+// Upgrade upgrades an HTTP/3 request to a WebTransport session.
+// Only valid when EnableWebTransport is true.
+func (s *Server) Upgrade(w http.ResponseWriter, r *http.Request) (*webtransport.Session, error) {
+	return s.wtServer.Upgrade(w, r)
+}
diff --git a/internal/protocols/httpp3/server_test.go b/internal/protocols/httpp3/server_test.go
new file mode 100644
index 00000000..6e025dba
--- /dev/null
+++ b/internal/protocols/httpp3/server_test.go
@@ -0,0 +1,43 @@
+package httpp3
+
+import (
+	"crypto/tls"
+	"io"
+	"net/http"
+	"testing"
+
+	"github.com/bluenviron/mediamtx/internal/test"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/stretchr/testify/require"
+)
+
+func TestServer(t *testing.T) {
+	// test that Server can be initialized and reached by a simple GET request
+	s := &Server{
+		Address: "127.0.0.1:18443",
+		Handler: http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusOK)
+		}),
+		Parent: test.NilLogger,
+	}
+	err := s.Initialize()
+	require.NoError(t, err)
+	defer s.Close()
+
+	tr := &http3.Transport{
+		TLSClientConfig: &tls.Config{
+			InsecureSkipVerify: true, //nolint:gosec
+		},
+	}
+	defer tr.Close() //nolint:errcheck
+	hc := &http.Client{Transport: tr}
+
+	res, err := hc.Get("https://127.0.0.1:18443/")
+	require.NoError(t, err)
+	defer res.Body.Close()
+
+	require.Equal(t, http.StatusOK, res.StatusCode)
+
+	_, err = io.ReadAll(res.Body)
+	require.NoError(t, err)
+}
diff --git a/internal/protocols/moq/catalog/catalog.go b/internal/protocols/moq/catalog/catalog.go
new file mode 100644
index 00000000..89fe0af8
--- /dev/null
+++ b/internal/protocols/moq/catalog/catalog.go
@@ -0,0 +1,26 @@
+// Package catalog contains a media catalog.
+package catalog
+
+// Catalog is a media catalog.
+// spec: draft-ietf-moq-msf-00
+type Catalog struct {
+	Version int     `json:"version"`
+	Tracks  []Track `json:"tracks"`
+}
+
+// Track is a track in a media catalog.
+type Track struct {
+	Name       string  `json:"name"`
+	Packaging  string  `json:"packaging"`
+	IsLive     bool    `json:"isLive"`
+	Namespace  string  `json:"namespace,omitempty"`
+	Codec      string  `json:"codec,omitempty"`
+	Bitrate    int     `json:"bitrate,omitempty"`
+	Width      int     `json:"width,omitempty"`
+	Height     int     `json:"height,omitempty"`
+	Framerate  float64 `json:"framerate,omitempty"`
+	Samplerate int     `json:"samplerate,omitempty"`
+	Channels   int     `json:"channels,omitempty"`
+	ClockRate  int     `json:"clockrate,omitempty"`
+	InitData   string  `json:"initData,omitempty"`
+}
diff --git a/internal/protocols/moq/controlmessage/message.go b/internal/protocols/moq/controlmessage/message.go
new file mode 100644
index 00000000..6f3da82f
--- /dev/null
+++ b/internal/protocols/moq/controlmessage/message.go
@@ -0,0 +1,65 @@
+// Package controlmessage contains MoQ control messages.
+package controlmessage
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/varint"
+)
+
+// Message is a control message.
+type Message interface {
+	// Marshal encodes the message to bytes.
+	Marshal() []byte
+
+	isMessage()
+	unmarshal(buf []byte) error
+}
+
+// Read reads a Message from a Reader.
+func Read(r io.Reader) (Message, error) {
+	var t varint.Varint
+	if err := t.Read(r); err != nil {
+		return nil, err
+	}
+
+	var lenBuf [2]byte
+	_, err := io.ReadFull(r, lenBuf[:])
+	if err != nil {
+		return nil, err
+	}
+	length := uint16(lenBuf[0])<<8 | uint16(lenBuf[1])
+
+	payload := make([]byte, length)
+	_, err = io.ReadFull(r, payload)
+	if err != nil {
+		return nil, err
+	}
+
+	var m Message
+
+	switch t {
+	case typeSetup:
+		m = &Setup{}
+	case typeSubscribe:
+		m = &Subscribe{}
+	case typeSubscribeOk:
+		m = &SubscribeOk{}
+	case typeRequestError:
+		m = &RequestError{}
+	case typePublish:
+		m = &Publish{}
+	case typeRequestOk:
+		m = &RequestOk{}
+	default:
+		return nil, fmt.Errorf("unknown message type: 0x%x", t)
+	}
+
+	err = m.unmarshal(payload)
+	if err != nil {
+		return nil, err
+	}
+
+	return m, nil
+}
diff --git a/internal/protocols/moq/controlmessage/message_test.go b/internal/protocols/moq/controlmessage/message_test.go
new file mode 100644
index 00000000..5d0a2066
--- /dev/null
+++ b/internal/protocols/moq/controlmessage/message_test.go
@@ -0,0 +1,174 @@
+package controlmessage
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/parameter"
+	"github.com/stretchr/testify/require"
+)
+
+var cases = []struct {
+	name string
+	enc  []byte
+	dec  Message
+}{
+	{
+		name: "setup",
+		enc: []byte{
+			0xAF, 0x00, // type 0x2F00 (2-byte varint)
+			0x00, 0x00, // length = 0
+		},
+		dec: &Setup{},
+	},
+	{
+		name: "subscribe",
+		enc: []byte{
+			0x03,       // type 0x03
+			0x00, 0x0B, // length = 11
+			0x01,                   // RequestID = 1
+			0x01,                   // namespace count = 1
+			0x03, 0x66, 0x6F, 0x6F, // namespace[0] = "foo"
+			0x03, 0x62, 0x61, 0x72, // track name = "bar"
+			0x00, // parameters count = 0
+		},
+		dec: &Subscribe{
+			RequestID: 1,
+			Namespace: []string{"foo"},
+			TrackName: "bar",
+		},
+	},
+	{
+		name: "subscribe with params",
+		enc: []byte{
+			0x03,       // type 0x03
+			0x00, 0x15, // length = 21
+			0x01,                   // RequestID = 1
+			0x01,                   // namespace count = 1
+			0x03, 0x66, 0x6F, 0x6F, // namespace[0] = "foo"
+			0x03, 0x62, 0x61, 0x72, // track name = "bar"
+			0x01,                               // parameters count = 1
+			0x03,                               // type delta = 3 (AuthorizationToken)
+			0x08,                               // inner length = 8
+			0x03,                               // alias type = UseValue
+			0x01,                               // token type = 1
+			0x73, 0x65, 0x63, 0x72, 0x65, 0x74, // token value = "secret"
+		},
+		dec: &Subscribe{
+			RequestID: 1,
+			Namespace: []string{"foo"},
+			TrackName: "bar",
+			Parameters: []parameter.Parameter{
+				&parameter.AuthorizationToken{
+					AliasType:  parameter.AuthorizationTokenAliasTypeUseValue,
+					TokenType:  1,
+					TokenValue: []byte("secret"),
+				},
+			},
+		},
+	},
+	{
+		name: "subscribe_ok",
+		enc: []byte{
+			0x04,       // type 0x04
+			0x00, 0x02, // length = 2
+			0x01, // TrackAlias = 1
+			0x00, // Number of Parameters = 0
+		},
+		dec: &SubscribeOk{
+			TrackAlias: 1,
+		},
+	},
+	{
+		name: "request_error",
+		enc: []byte{
+			0x05,       // type 0x05
+			0x00, 0x06, // length = 6
+			0x01,                   // Code = 1
+			0x00,                   // retryInterval = 0 (ignored)
+			0x03, 0x66, 0x6F, 0x6F, // Reason = "foo"
+		},
+		dec: &RequestError{
+			Code:   1,
+			Reason: "foo",
+		},
+	},
+	{
+		name: "request_ok",
+		enc: []byte{
+			0x07,       // type 0x07
+			0x00, 0x01, // length = 1
+			0x00, // Number of Parameters = 0
+		},
+		dec: &RequestOk{},
+	},
+	{
+		name: "publish",
+		enc: []byte{
+			0x1D,       // type 0x1D
+			0x00, 0x0C, // length = 12
+			0x01,                   // RequestID = 1
+			0x01,                   // namespace count = 1
+			0x03, 0x66, 0x6F, 0x6F, // namespace[0] = "foo"
+			0x03, 0x62, 0x61, 0x72, // track name = "bar"
+			0x02, // TrackAlias = 2
+			0x00, // parameters count = 0
+		},
+		dec: &Publish{
+			RequestID:  1,
+			Namespace:  []string{"foo"},
+			TrackName:  "bar",
+			TrackAlias: 2,
+		},
+	},
+	{
+		name: "publish with parameters",
+		enc: []byte{
+			0x1D,       // type 0x1D
+			0x00, 0x16, // length = 22
+			0x01,                   // RequestID = 1
+			0x01,                   // namespace count = 1
+			0x03, 0x66, 0x6F, 0x6F, // namespace[0] = "foo"
+			0x03, 0x62, 0x61, 0x72, // track name = "bar"
+			0x02,                               // TrackAlias = 2
+			0x01,                               // parameters count = 1
+			0x03,                               // type delta = 3 (AuthorizationToken)
+			0x08,                               // inner length = 8
+			0x03,                               // alias type = UseValue
+			0x01,                               // token type = 1
+			0x73, 0x65, 0x63, 0x72, 0x65, 0x74, // token value = "secret"
+		},
+		dec: &Publish{
+			RequestID:  1,
+			Namespace:  []string{"foo"},
+			TrackName:  "bar",
+			TrackAlias: 2,
+			Parameters: []parameter.Parameter{
+				&parameter.AuthorizationToken{
+					AliasType:  parameter.AuthorizationTokenAliasTypeUseValue,
+					TokenType:  1,
+					TokenValue: []byte("secret"),
+				},
+			},
+		},
+	},
+}
+
+func TestUnmarshal(t *testing.T) {
+	for _, ca := range cases {
+		t.Run(ca.name, func(t *testing.T) {
+			m, err := Read(bytes.NewReader(ca.enc))
+			require.NoError(t, err)
+			require.Equal(t, ca.dec, m)
+		})
+	}
+}
+
+func TestMarshal(t *testing.T) {
+	for _, ca := range cases {
+		t.Run(ca.name, func(t *testing.T) {
+			buf := ca.dec.Marshal()
+			require.Equal(t, ca.enc, buf)
+		})
+	}
+}
diff --git a/internal/protocols/moq/controlmessage/publish.go b/internal/protocols/moq/controlmessage/publish.go
new file mode 100644
index 00000000..070029ce
--- /dev/null
+++ b/internal/protocols/moq/controlmessage/publish.go
@@ -0,0 +1,145 @@
+package controlmessage
+
+import (
+	"fmt"
+
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/parameter"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/property"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/varint"
+)
+
+const typePublish varint.Varint = 0x1d
+
+// Publish is the PUBLISH control message.
+// spec: draft-18, section 10.10
+type Publish struct {
+	RequestID       uint64
+	Namespace       []string
+	TrackName       string
+	TrackAlias      uint64
+	Parameters      parameter.Parameters
+	TrackProperties property.Properties
+}
+
+func (*Publish) isMessage() {}
+
+func (m *Publish) unmarshal(buf []byte) error {
+	var requestID varint.Varint
+	n, err := requestID.Unmarshal(buf)
+	if err != nil {
+		return err
+	}
+	m.RequestID = uint64(requestID)
+	buf = buf[n:]
+
+	var nsCount varint.Varint
+	n, err = nsCount.Unmarshal(buf)
+	if err != nil {
+		return err
+	}
+	buf = buf[n:]
+
+	m.Namespace = make([]string, nsCount)
+	for i := range m.Namespace {
+		var l varint.Varint
+		n, err = l.Unmarshal(buf)
+		if err != nil {
+			return err
+		}
+		buf = buf[n:]
+		if len(buf) < int(l) {
+			return fmt.Errorf("not enough bytes for namespace part")
+		}
+		m.Namespace[i] = string(buf[:l])
+		buf = buf[int(l):]
+	}
+
+	var tnLen varint.Varint
+	n, err = tnLen.Unmarshal(buf)
+	if err != nil {
+		return err
+	}
+	buf = buf[n:]
+	if len(buf) < int(tnLen) {
+		return fmt.Errorf("not enough bytes for track name")
+	}
+	m.TrackName = string(buf[:tnLen])
+	buf = buf[int(tnLen):]
+
+	var trackAlias varint.Varint
+	n, err = trackAlias.Unmarshal(buf)
+	if err != nil {
+		return err
+	}
+	m.TrackAlias = uint64(trackAlias)
+	buf = buf[n:]
+
+	var paramCount varint.Varint
+	n, err = paramCount.Unmarshal(buf)
+	if err != nil {
+		return err
+	}
+	buf = buf[n:]
+
+	consumed, err := m.Parameters.Unmarshal(int(paramCount), buf)
+	if err != nil {
+		return err
+	}
+	buf = buf[consumed:]
+
+	return m.TrackProperties.Unmarshal(buf)
+}
+
+func (m Publish) marshalSize() int {
+	n := varint.Varint(m.RequestID).MarshalSize() +
+		varint.Varint(len(m.Namespace)).MarshalSize()
+	for _, part := range m.Namespace {
+		n += varint.Varint(len(part)).MarshalSize() + len(part)
+	}
+	n += varint.Varint(len(m.TrackName)).MarshalSize() + len(m.TrackName)
+	n += varint.Varint(m.TrackAlias).MarshalSize()
+	n += varint.Varint(len(m.Parameters)).MarshalSize()
+	n += m.Parameters.MarshalSize()
+	n += m.TrackProperties.MarshalSize()
+
+	return typePublish.MarshalSize() + 2 + n
+}
+
+func (m Publish) marshalTo(buf []byte) int {
+	payloadSize := varint.Varint(m.RequestID).MarshalSize() +
+		varint.Varint(len(m.Namespace)).MarshalSize()
+	for _, part := range m.Namespace {
+		payloadSize += varint.Varint(len(part)).MarshalSize() + len(part)
+	}
+	payloadSize += varint.Varint(len(m.TrackName)).MarshalSize() + len(m.TrackName)
+	payloadSize += varint.Varint(m.TrackAlias).MarshalSize()
+	payloadSize += varint.Varint(len(m.Parameters)).MarshalSize()
+	payloadSize += m.Parameters.MarshalSize()
+	payloadSize += m.TrackProperties.MarshalSize()
+
+	n := typePublish.MarshalTo(buf)
+	buf[n] = byte(payloadSize >> 8)
+	buf[n+1] = byte(payloadSize)
+	n += 2
+	n += varint.Varint(m.RequestID).MarshalTo(buf[n:])
+	n += varint.Varint(len(m.Namespace)).MarshalTo(buf[n:])
+	for _, part := range m.Namespace {
+		n += varint.Varint(len(part)).MarshalTo(buf[n:])
+		n += copy(buf[n:], part)
+	}
+	n += varint.Varint(len(m.TrackName)).MarshalTo(buf[n:])
+	n += copy(buf[n:], m.TrackName)
+	n += varint.Varint(m.TrackAlias).MarshalTo(buf[n:])
+	n += varint.Varint(len(m.Parameters)).MarshalTo(buf[n:])
+	n += m.Parameters.MarshalTo(buf[n:])
+	n += m.TrackProperties.MarshalTo(buf[n:])
+
+	return n
+}
+
+// Marshal implements Message.
+func (m Publish) Marshal() []byte {
+	buf := make([]byte, m.marshalSize())
+	m.marshalTo(buf)
+	return buf
+}
diff --git a/internal/protocols/moq/controlmessage/request_error.go b/internal/protocols/moq/controlmessage/request_error.go
new file mode 100644
index 00000000..f4e285e7
--- /dev/null
+++ b/internal/protocols/moq/controlmessage/request_error.go
@@ -0,0 +1,87 @@
+package controlmessage
+
+import (
+	"fmt"
+
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/varint"
+)
+
+const typeRequestError varint.Varint = 0x05
+
+// RequestErrorCode is a code of REQUEST_ERROR.
+type RequestErrorCode uint64
+
+// spec: draft-18, section 15.10.2
+const (
+	RequestErrorCodeUnauthorized RequestErrorCode = 0x01
+	RequestErrorCodeNotSupported RequestErrorCode = 0x03
+	RequestErrorCodeDoesNotExist RequestErrorCode = 0x10
+	RequestErrorCodeUninterested RequestErrorCode = 0x20
+)
+
+// RequestError is the REQUEST_ERROR control message.
+// spec: draft-18, section 10.6.2
+type RequestError struct {
+	Code   RequestErrorCode
+	Reason string
+}
+
+func (*RequestError) isMessage() {}
+
+func (m *RequestError) unmarshal(buf []byte) error {
+	var code varint.Varint
+	n, err := code.Unmarshal(buf)
+	if err != nil {
+		return err
+	}
+	m.Code = RequestErrorCode(code)
+	buf = buf[n:]
+
+	var retry varint.Varint
+	n, err = retry.Unmarshal(buf)
+	if err != nil {
+		return err
+	}
+	buf = buf[n:]
+
+	var l varint.Varint
+	n, err = l.Unmarshal(buf)
+	if err != nil {
+		return err
+	}
+	buf = buf[n:]
+	if len(buf) < int(l) {
+		return fmt.Errorf("not enough bytes")
+	}
+	m.Reason = string(buf[:l])
+
+	return nil
+}
+
+func (m RequestError) marshalSize() int {
+	payloadSize := varint.Varint(m.Code).MarshalSize() + 1 +
+		varint.Varint(len(m.Reason)).MarshalSize() + len(m.Reason)
+	return typeRequestError.MarshalSize() + 2 + payloadSize
+}
+
+func (m RequestError) marshalTo(buf []byte) int {
+	payloadSize := varint.Varint(m.Code).MarshalSize() + 1 +
+		varint.Varint(len(m.Reason)).MarshalSize() + len(m.Reason)
+	n := typeRequestError.MarshalTo(buf)
+	buf[n] = byte(payloadSize >> 8)
+	buf[n+1] = byte(payloadSize)
+	n += 2
+	n += varint.Varint(m.Code).MarshalTo(buf[n:])
+	buf[n] = 0x00
+	n++
+	n += varint.Varint(len(m.Reason)).MarshalTo(buf[n:])
+	n += copy(buf[n:], m.Reason)
+	return n
+}
+
+// Marshal implements Message.
+func (m RequestError) Marshal() []byte {
+	buf := make([]byte, m.marshalSize())
+	m.marshalTo(buf)
+	return buf
+}
diff --git a/internal/protocols/moq/controlmessage/request_ok.go b/internal/protocols/moq/controlmessage/request_ok.go
new file mode 100644
index 00000000..751b290c
--- /dev/null
+++ b/internal/protocols/moq/controlmessage/request_ok.go
@@ -0,0 +1,63 @@
+package controlmessage
+
+import (
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/parameter"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/property"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/varint"
+)
+
+const typeRequestOk varint.Varint = 0x07
+
+// RequestOk is the REQUEST_OK control message.
+// spec: draft-18, section 10.5
+type RequestOk struct {
+	Parameters      parameter.Parameters
+	TrackProperties property.Properties
+}
+
+func (*RequestOk) isMessage() {}
+
+func (m *RequestOk) unmarshal(buf []byte) error {
+	var numParams varint.Varint
+	n, err := numParams.Unmarshal(buf)
+	if err != nil {
+		return err
+	}
+	buf = buf[n:]
+
+	consumed, err := m.Parameters.Unmarshal(int(numParams), buf)
+	if err != nil {
+		return err
+	}
+	buf = buf[consumed:]
+
+	return m.TrackProperties.Unmarshal(buf)
+}
+
+func (m RequestOk) marshalSize() int {
+	payloadSize := varint.Varint(len(m.Parameters)).MarshalSize() +
+		m.Parameters.MarshalSize() +
+		m.TrackProperties.MarshalSize()
+	return typeRequestOk.MarshalSize() + 2 + payloadSize
+}
+
+func (m RequestOk) marshalTo(buf []byte) int {
+	payloadSize := varint.Varint(len(m.Parameters)).MarshalSize() +
+		m.Parameters.MarshalSize() +
+		m.TrackProperties.MarshalSize()
+	n := typeRequestOk.MarshalTo(buf)
+	buf[n] = byte(payloadSize >> 8)
+	buf[n+1] = byte(payloadSize)
+	n += 2
+	n += varint.Varint(len(m.Parameters)).MarshalTo(buf[n:])
+	n += m.Parameters.MarshalTo(buf[n:])
+	n += m.TrackProperties.MarshalTo(buf[n:])
+	return n
+}
+
+// Marshal implements Message.
+func (m RequestOk) Marshal() []byte {
+	buf := make([]byte, m.marshalSize())
+	m.marshalTo(buf)
+	return buf
+}
diff --git a/internal/protocols/moq/controlmessage/setup.go b/internal/protocols/moq/controlmessage/setup.go
new file mode 100644
index 00000000..52cc0f44
--- /dev/null
+++ b/internal/protocols/moq/controlmessage/setup.go
@@ -0,0 +1,31 @@
+package controlmessage
+
+import "github.com/bluenviron/mediamtx/internal/protocols/moq/varint"
+
+const typeSetup varint.Varint = 0x2F00
+
+// Setup is the SETUP control message.
+// spec: draft-18, section 10.3
+type Setup struct{}
+
+func (*Setup) isMessage() {}
+
+func (*Setup) unmarshal(_ []byte) error { return nil }
+
+func (Setup) marshalSize() int {
+	return typeSetup.MarshalSize() + 2
+}
+
+func (Setup) marshalTo(buf []byte) int {
+	pos := typeSetup.MarshalTo(buf)
+	buf[pos] = 0x00
+	buf[pos+1] = 0x00
+	return pos + 2
+}
+
+// Marshal implements Message.
+func (Setup) Marshal() []byte {
+	buf := make([]byte, Setup{}.marshalSize())
+	Setup{}.marshalTo(buf)
+	return buf
+}
diff --git a/internal/protocols/moq/controlmessage/subscribe.go b/internal/protocols/moq/controlmessage/subscribe.go
new file mode 100644
index 00000000..6a7c3524
--- /dev/null
+++ b/internal/protocols/moq/controlmessage/subscribe.go
@@ -0,0 +1,128 @@
+package controlmessage
+
+import (
+	"fmt"
+
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/parameter"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/varint"
+)
+
+const typeSubscribe varint.Varint = 0x03
+
+// Subscribe is the SUBSCRIBE control message.
+// spec: draft-18, section 10.7
+type Subscribe struct {
+	RequestID  uint64
+	Namespace  []string
+	TrackName  string
+	Parameters parameter.Parameters
+}
+
+func (*Subscribe) isMessage() {}
+
+func (m *Subscribe) unmarshal(buf []byte) error {
+	var requestID varint.Varint
+	n, err := requestID.Unmarshal(buf)
+	if err != nil {
+		return err
+	}
+	m.RequestID = uint64(requestID)
+	buf = buf[n:]
+
+	var nsCount varint.Varint
+	n, err = nsCount.Unmarshal(buf)
+	if err != nil {
+		return err
+	}
+	buf = buf[n:]
+
+	m.Namespace = make([]string, nsCount)
+	for i := range m.Namespace {
+		var l varint.Varint
+		n, err = l.Unmarshal(buf)
+		if err != nil {
+			return err
+		}
+		buf = buf[n:]
+		if len(buf) < int(l) {
+			return fmt.Errorf("not enough bytes for namespace part")
+		}
+		m.Namespace[i] = string(buf[:l])
+		buf = buf[int(l):]
+	}
+
+	var tnLen varint.Varint
+	n, err = tnLen.Unmarshal(buf)
+	if err != nil {
+		return err
+	}
+	buf = buf[n:]
+	if len(buf) < int(tnLen) {
+		return fmt.Errorf("not enough bytes for track name")
+	}
+	m.TrackName = string(buf[:tnLen])
+	buf = buf[int(tnLen):]
+
+	var paramCount varint.Varint
+	n, err = paramCount.Unmarshal(buf)
+	if err != nil {
+		return err
+	}
+	buf = buf[n:]
+
+	_, err = m.Parameters.Unmarshal(int(paramCount), buf)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (m Subscribe) marshalSize() int {
+	n := varint.Varint(m.RequestID).MarshalSize() +
+		varint.Varint(len(m.Namespace)).MarshalSize()
+	for _, part := range m.Namespace {
+		n += varint.Varint(len(part)).MarshalSize() + len(part)
+	}
+	n += varint.Varint(len(m.TrackName)).MarshalSize() + len(m.TrackName)
+	n += varint.Varint(len(m.Parameters)).MarshalSize()
+	n += m.Parameters.MarshalSize()
+
+	return typeSubscribe.MarshalSize() + 2 + n
+}
+
+func (m Subscribe) marshalTo(buf []byte) int {
+	payloadSize := varint.Varint(m.RequestID).MarshalSize() +
+		varint.Varint(len(m.Namespace)).MarshalSize()
+	for _, part := range m.Namespace {
+		payloadSize += varint.Varint(len(part)).MarshalSize() + len(part)
+	}
+	payloadSize += varint.Varint(len(m.TrackName)).MarshalSize() + len(m.TrackName)
+	payloadSize += varint.Varint(len(m.Parameters)).MarshalSize()
+	payloadSize += m.Parameters.MarshalSize()
+
+	n := typeSubscribe.MarshalTo(buf)
+	buf[n] = byte(payloadSize >> 8)
+	buf[n+1] = byte(payloadSize)
+	n += 2
+	n += varint.Varint(m.RequestID).MarshalTo(buf[n:])
+	n += varint.Varint(len(m.Namespace)).MarshalTo(buf[n:])
+	for _, part := range m.Namespace {
+		n += varint.Varint(len(part)).MarshalTo(buf[n:])
+		n += copy(buf[n:], part)
+	}
+	n += varint.Varint(len(m.TrackName)).MarshalTo(buf[n:])
+	n += copy(buf[n:], m.TrackName)
+
+	n += varint.Varint(len(m.Parameters)).MarshalTo(buf[n:])
+	n += m.Parameters.MarshalTo(buf[n:])
+
+	return n
+}
+
+// Marshal implements Message.
+func (m Subscribe) Marshal() []byte {
+	buf := make([]byte, m.marshalSize())
+	m.marshalTo(buf)
+	return buf
+}
diff --git a/internal/protocols/moq/controlmessage/subscribe_ok.go b/internal/protocols/moq/controlmessage/subscribe_ok.go
new file mode 100644
index 00000000..3deb67ed
--- /dev/null
+++ b/internal/protocols/moq/controlmessage/subscribe_ok.go
@@ -0,0 +1,75 @@
+package controlmessage
+
+import (
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/parameter"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/property"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/varint"
+)
+
+const typeSubscribeOk varint.Varint = 0x04
+
+// SubscribeOk is the SUBSCRIBE_OK control message.
+// spec: draft-18, section 10.8
+type SubscribeOk struct {
+	TrackAlias      uint64
+	Parameters      parameter.Parameters
+	TrackProperties property.Properties
+}
+
+func (*SubscribeOk) isMessage() {}
+
+func (m *SubscribeOk) unmarshal(buf []byte) error {
+	var v varint.Varint
+	n, err := v.Unmarshal(buf)
+	if err != nil {
+		return err
+	}
+	m.TrackAlias = uint64(v)
+	buf = buf[n:]
+
+	var numParams varint.Varint
+	n, err = numParams.Unmarshal(buf)
+	if err != nil {
+		return err
+	}
+	buf = buf[n:]
+
+	consumed, err := m.Parameters.Unmarshal(int(numParams), buf)
+	if err != nil {
+		return err
+	}
+	buf = buf[consumed:]
+
+	return m.TrackProperties.Unmarshal(buf)
+}
+
+func (m SubscribeOk) marshalSize() int {
+	payloadSize := varint.Varint(m.TrackAlias).MarshalSize() +
+		varint.Varint(len(m.Parameters)).MarshalSize() +
+		m.Parameters.MarshalSize() +
+		m.TrackProperties.MarshalSize()
+	return typeSubscribeOk.MarshalSize() + 2 + payloadSize
+}
+
+func (m SubscribeOk) marshalTo(buf []byte) int {
+	payloadSize := varint.Varint(m.TrackAlias).MarshalSize() +
+		varint.Varint(len(m.Parameters)).MarshalSize() +
+		m.Parameters.MarshalSize() +
+		m.TrackProperties.MarshalSize()
+	n := typeSubscribeOk.MarshalTo(buf)
+	buf[n] = byte(payloadSize >> 8)
+	buf[n+1] = byte(payloadSize)
+	n += 2
+	n += varint.Varint(m.TrackAlias).MarshalTo(buf[n:])
+	n += varint.Varint(len(m.Parameters)).MarshalTo(buf[n:])
+	n += m.Parameters.MarshalTo(buf[n:])
+	n += m.TrackProperties.MarshalTo(buf[n:])
+	return n
+}
+
+// Marshal implements Message.
+func (m SubscribeOk) Marshal() []byte {
+	buf := make([]byte, m.marshalSize())
+	m.marshalTo(buf)
+	return buf
+}
diff --git a/internal/protocols/moq/from_stream.go b/internal/protocols/moq/from_stream.go
new file mode 100644
index 00000000..f3eec12c
--- /dev/null
+++ b/internal/protocols/moq/from_stream.go
@@ -0,0 +1,318 @@
+// Package moq contains Media-over-QUIC utilities.
+package moq
+
+import (
+	"encoding/base64"
+	"encoding/hex"
+	"strings"
+
+	"github.com/bluenviron/gortsplib/v5/pkg/description"
+	"github.com/bluenviron/gortsplib/v5/pkg/format"
+	"github.com/bluenviron/mediacommon/v2/pkg/codecs/av1"
+	"github.com/bluenviron/mediacommon/v2/pkg/codecs/flac"
+	"github.com/bluenviron/mediacommon/v2/pkg/codecs/g711"
+	"github.com/bluenviron/mediacommon/v2/pkg/codecs/h264"
+	"github.com/bluenviron/mediacommon/v2/pkg/codecs/h265"
+	"github.com/bluenviron/mediacommon/v2/pkg/codecs/mpeg4audio"
+	"github.com/bluenviron/mediacommon/v2/pkg/codecs/vp8"
+	"github.com/bluenviron/mediacommon/v2/pkg/codecs/vp9"
+	"github.com/bluenviron/mediamtx/internal/unit"
+)
+
+// FromStream maps a MediaMTX stream to a Media-over-QUIC stream.
+func FromStream(desc *description.Session) ([]*Track, error) {
+	var tracks []*Track
+
+	for _, media := range desc.Medias {
+		for _, forma := range media.Formats {
+			switch forma := forma.(type) {
+			case *format.AV1:
+				firstRandomAccess := false
+
+				track := &Track{
+					Codec:  "av01.0.04M.08",
+					Media:  media,
+					Format: forma,
+					OnData: func(u *unit.Unit, wrapped func([]byte, int64) error) error {
+						if u.NilPayload() {
+							return nil
+						}
+
+						if !firstRandomAccess && !av1.IsRandomAccess2(u.Payload.(unit.PayloadAV1)) {
+							return nil
+						}
+						firstRandomAccess = true
+
+						payload, err := av1.Bitstream([][]byte(u.Payload.(unit.PayloadAV1))).Marshal()
+						if err != nil {
+							return err
+						}
+
+						return wrapped(payload, u.PTS)
+					},
+				}
+				tracks = append(tracks, track)
+
+			case *format.VP9:
+				firstRandomAccess := false
+
+				track := &Track{
+					Codec:  "vp09.00.10.08",
+					Media:  media,
+					Format: forma,
+					OnData: func(u *unit.Unit, wrapped func([]byte, int64) error) error {
+						if u.NilPayload() {
+							return nil
+						}
+
+						if !firstRandomAccess && !vp9.IsRandomAccess(u.Payload.(unit.PayloadVP9)) {
+							return nil
+						}
+						firstRandomAccess = true
+
+						return wrapped(u.Payload.(unit.PayloadVP9), u.PTS)
+					},
+				}
+				tracks = append(tracks, track)
+
+			case *format.VP8:
+				firstRandomAccess := false
+
+				track := &Track{
+					Codec:  "vp8",
+					Media:  media,
+					Format: forma,
+					OnData: func(u *unit.Unit, wrapped func([]byte, int64) error) error {
+						if u.NilPayload() {
+							return nil
+						}
+
+						if !firstRandomAccess && !vp8.IsRandomAccess(u.Payload.(unit.PayloadVP8)) {
+							return nil
+						}
+						firstRandomAccess = true
+
+						return wrapped(u.Payload.(unit.PayloadVP8), u.PTS)
+					},
+				}
+				tracks = append(tracks, track)
+
+			case *format.H265:
+				firstRandomAccess := false
+
+				track := &Track{
+					Codec:  "hev1.1.6.L93.B0",
+					Media:  media,
+					Format: forma,
+					OnData: func(u *unit.Unit, wrapped func([]byte, int64) error) error {
+						if u.NilPayload() {
+							return nil
+						}
+
+						if !firstRandomAccess && !h265.IsRandomAccess(u.Payload.(unit.PayloadH265)) {
+							return nil
+						}
+						firstRandomAccess = true
+
+						payload, err := h264.AVCC(u.Payload.(unit.PayloadH265)).Marshal()
+						if err != nil {
+							return err
+						}
+
+						return wrapped(payload, u.PTS)
+					},
+				}
+				tracks = append(tracks, track)
+
+			case *format.H264:
+				firstRandomAccess := false
+
+				track := &Track{
+					Codec:  "avc3.640028",
+					Media:  media,
+					Format: forma,
+					OnData: func(u *unit.Unit, wrapped func([]byte, int64) error) error {
+						if u.NilPayload() {
+							return nil
+						}
+
+						if !firstRandomAccess && !h264.IsRandomAccess(u.Payload.(unit.PayloadH264)) {
+							return nil
+						}
+						firstRandomAccess = true
+
+						payload, err := h264.AVCC(u.Payload.(unit.PayloadH264)).Marshal()
+						if err != nil {
+							return err
+						}
+
+						return wrapped(payload, u.PTS)
+					},
+				}
+				tracks = append(tracks, track)
+
+			case *format.Opus:
+				track := &Track{
+					Codec:      "opus",
+					Samplerate: 48000,
+					Channels:   forma.ChannelCount,
+					Media:      media,
+					Format:     forma,
+					OnData: func(u *unit.Unit, wrapped func([]byte, int64) error) error {
+						if u.NilPayload() {
+							return nil
+						}
+
+						for _, pkt := range u.Payload.(unit.PayloadOpus) {
+							err := wrapped(pkt, u.PTS)
+							if err != nil {
+								return err
+							}
+						}
+						return nil
+					},
+				}
+				tracks = append(tracks, track)
+
+			case *format.Generic:
+				if strings.HasPrefix(strings.ToLower(forma.RTPMap()), "flac/") {
+					enc, err := hex.DecodeString(forma.FMT["streaminfo"])
+					if err != nil {
+						return nil, err
+					}
+
+					var streamInfo flac.StreamInfo
+					err = streamInfo.Unmarshal(enc)
+					if err != nil {
+						return nil, err
+					}
+
+					track := &Track{
+						Codec:      "flac",
+						Samplerate: int(streamInfo.SampleRate),
+						Channels:   int(streamInfo.ChannelCount),
+						InitData:   base64.StdEncoding.EncodeToString(enc),
+						Media:      media,
+						Format:     forma,
+						OnData: func(u *unit.Unit, wrapped func([]byte, int64) error) error {
+							if u.NilPayload() {
+								return nil
+							}
+
+							return wrapped(u.Payload.(unit.PayloadFLAC), u.PTS)
+						},
+					}
+					tracks = append(tracks, track)
+				}
+
+			case *format.MPEG4Audio:
+				if forma.Config != nil {
+					enc, err := forma.Config.Marshal()
+					if err != nil {
+						return nil, err
+					}
+
+					track := &Track{
+						Codec:      "mp4a.40.2",
+						Samplerate: forma.Config.SampleRate,
+						Channels:   int(forma.Config.ChannelConfig),
+						InitData:   base64.StdEncoding.EncodeToString(enc),
+						Media:      media,
+						Format:     forma,
+						OnData: func(u *unit.Unit, wrapped func([]byte, int64) error) error {
+							if u.NilPayload() {
+								return nil
+							}
+
+							pts := u.PTS
+
+							for _, au := range u.Payload.(unit.PayloadMPEG4Audio) {
+								err2 := wrapped(au, pts)
+								if err2 != nil {
+									return err2
+								}
+
+								pts += mpeg4audio.SamplesPerAccessUnit
+							}
+							return nil
+						},
+					}
+					tracks = append(tracks, track)
+				}
+
+			case *format.G711:
+				track := &Track{
+					Codec:      "pcm-s16",
+					Samplerate: forma.SampleRate,
+					Channels:   forma.ChannelCount,
+					Media:      media,
+					Format:     forma,
+					OnData: func(u *unit.Unit, wrapped func([]byte, int64) error) error {
+						if u.NilPayload() {
+							return nil
+						}
+
+						var bigEndian []byte
+						if forma.MULaw {
+							var mu g711.Mulaw
+							mu.Unmarshal(u.Payload.(unit.PayloadG711))
+							bigEndian = mu
+						} else {
+							var al g711.Alaw
+							al.Unmarshal(u.Payload.(unit.PayloadG711))
+							bigEndian = al
+						}
+
+						swapped := make([]byte, len(bigEndian))
+						for i := 0; i+2 <= len(bigEndian); i += 2 {
+							swapped[i], swapped[i+1] = bigEndian[i+1], bigEndian[i]
+						}
+
+						return wrapped(swapped, u.PTS)
+					},
+				}
+				tracks = append(tracks, track)
+
+			case *format.LPCM:
+				var codec string
+				switch forma.BitDepth {
+				case 8:
+					codec = "pcm-u8"
+				case 16:
+					codec = "pcm-s16"
+				case 24:
+					codec = "pcm-s24"
+				default: // 32
+					codec = "pcm-s32"
+				}
+
+				track := &Track{
+					Codec:      codec,
+					Samplerate: forma.SampleRate,
+					Channels:   forma.ChannelCount,
+					Media:      media,
+					Format:     forma,
+					OnData: func(u *unit.Unit, onData func([]byte, int64) error) error {
+						if u.NilPayload() {
+							return nil
+						}
+
+						src := []byte(u.Payload.(unit.PayloadLPCM))
+						byteDepth := forma.BitDepth / 8
+						swapped := make([]byte, len(src))
+						for i := 0; i+byteDepth <= len(src); i += byteDepth {
+							for j := range byteDepth {
+								swapped[i+j] = src[i+byteDepth-1-j]
+							}
+						}
+
+						return onData(swapped, u.PTS)
+					},
+				}
+				tracks = append(tracks, track)
+			}
+		}
+	}
+
+	return tracks, nil
+}
diff --git a/internal/protocols/moq/from_stream_test.go b/internal/protocols/moq/from_stream_test.go
new file mode 100644
index 00000000..c2fb4dac
--- /dev/null
+++ b/internal/protocols/moq/from_stream_test.go
@@ -0,0 +1,111 @@
+package moq
+
+import (
+	"encoding/base64"
+	"encoding/hex"
+	"testing"
+
+	"github.com/bluenviron/gortsplib/v5/pkg/description"
+	"github.com/bluenviron/gortsplib/v5/pkg/format"
+	"github.com/bluenviron/mediacommon/v2/pkg/codecs/flac"
+	"github.com/bluenviron/mediacommon/v2/pkg/codecs/mpeg4audio"
+	"github.com/stretchr/testify/require"
+)
+
+func TestFromStream(t *testing.T) {
+	flacEnc, err := (&flac.StreamInfo{
+		SampleRate:   44100,
+		ChannelCount: 2,
+		BitDepth:     16,
+	}).Marshal()
+	require.NoError(t, err)
+
+	mpeg4Config := &mpeg4audio.AudioSpecificConfig{
+		Type:          2,
+		SampleRate:    44100,
+		ChannelConfig: 2,
+	}
+	mpeg4Enc, err := mpeg4Config.Marshal()
+	require.NoError(t, err)
+
+	desc := &description.Session{
+		Medias: []*description.Media{
+			{Formats: []format.Format{&format.AV1{}}},
+			{Formats: []format.Format{&format.VP9{}}},
+			{Formats: []format.Format{&format.VP8{}}},
+			{Formats: []format.Format{&format.H265{}}},
+			{Formats: []format.Format{&format.H264{}}},
+			{Formats: []format.Format{&format.Opus{ChannelCount: 2}}},
+			{Formats: []format.Format{&format.Generic{
+				RTPMa:    "FLAC/44100/2",
+				ClockRat: 44100,
+				FMT:      map[string]string{"streaminfo": hex.EncodeToString(flacEnc)},
+			}}},
+			{Formats: []format.Format{&format.MPEG4Audio{
+				Config:           mpeg4Config,
+				SizeLength:       13,
+				IndexLength:      3,
+				IndexDeltaLength: 3,
+			}}},
+			{Formats: []format.Format{&format.G711{
+				SampleRate:   8000,
+				ChannelCount: 1,
+			}}},
+			{Formats: []format.Format{&format.LPCM{
+				BitDepth:     16,
+				SampleRate:   44100,
+				ChannelCount: 2,
+			}}},
+		},
+	}
+
+	tracks, err := FromStream(desc)
+	require.NoError(t, err)
+
+	for _, track := range tracks {
+		track.OnData = nil
+	}
+
+	require.Equal(t, []*Track{
+		{
+			Codec: "av01.0.04M.08", Media: desc.Medias[0],
+			Format: desc.Medias[0].Formats[0],
+		},
+		{
+			Codec: "vp09.00.10.08", Media: desc.Medias[1],
+			Format: desc.Medias[1].Formats[0],
+		},
+		{
+			Codec: "vp8", Media: desc.Medias[2],
+			Format: desc.Medias[2].Formats[0],
+		},
+		{
+			Codec: "hev1.1.6.L93.B0", Media: desc.Medias[3],
+			Format: desc.Medias[3].Formats[0],
+		},
+		{
+			Codec: "avc3.640028", Media: desc.Medias[4],
+			Format: desc.Medias[4].Formats[0],
+		},
+		{
+			Codec: "opus", Samplerate: 48000, Channels: 2,
+			Media: desc.Medias[5], Format: desc.Medias[5].Formats[0],
+		},
+		{
+			Codec: "flac", Samplerate: 44100, Channels: 2,
+			InitData: base64.StdEncoding.EncodeToString(flacEnc), Media: desc.Medias[6], Format: desc.Medias[6].Formats[0],
+		},
+		{
+			Codec: "mp4a.40.2", Samplerate: 44100, Channels: 2,
+			InitData: base64.StdEncoding.EncodeToString(mpeg4Enc), Media: desc.Medias[7], Format: desc.Medias[7].Formats[0],
+		},
+		{
+			Codec: "pcm-s16", Samplerate: 8000, Channels: 1,
+			Media: desc.Medias[8], Format: desc.Medias[8].Formats[0],
+		},
+		{
+			Codec: "pcm-s16", Samplerate: 44100, Channels: 2,
+			Media: desc.Medias[9], Format: desc.Medias[9].Formats[0],
+		},
+	}, tracks)
+}
diff --git a/internal/protocols/moq/parameter/authorization_token.go b/internal/protocols/moq/parameter/authorization_token.go
new file mode 100644
index 00000000..f8f4caf6
--- /dev/null
+++ b/internal/protocols/moq/parameter/authorization_token.go
@@ -0,0 +1,84 @@
+package parameter
+
+import (
+	"fmt"
+
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/varint"
+)
+
+const typeAuthorizationToken = 0x03
+
+// AuthorizationTokenAliasType is a value of Alias Type.
+// spec: draft-18, section 10.2.2
+type AuthorizationTokenAliasType uint64
+
+// spec: draft-18, section 10.2.2
+const (
+	AuthorizationTokenAliasTypeUseValue AuthorizationTokenAliasType = 0x03
+)
+
+// AuthorizationToken is the AUTHORIZATION_TOKEN parameter.
+// spec: draft-18, section 10.2.2
+type AuthorizationToken struct {
+	AliasType  AuthorizationTokenAliasType
+	TokenType  uint64
+	TokenValue []byte
+}
+
+func (*AuthorizationToken) isParameter() {}
+
+func (*AuthorizationToken) paramType() uint64 {
+	return typeAuthorizationToken
+}
+
+func (t *AuthorizationToken) unmarshal(buf []byte) (int, error) {
+	var le varint.Varint
+	llen, err := le.Unmarshal(buf)
+	if err != nil {
+		return 0, err
+	}
+	if len(buf)-llen < int(le) {
+		return 0, fmt.Errorf("not enough bytes for parameter value")
+	}
+	buf = buf[llen : llen+int(le)]
+
+	var aliasType varint.Varint
+	n, err := aliasType.Unmarshal(buf)
+	if err != nil {
+		return 0, err
+	}
+	t.AliasType = AuthorizationTokenAliasType(aliasType)
+
+	if t.AliasType != AuthorizationTokenAliasTypeUseValue {
+		return 0, fmt.Errorf("unsupported token alias type: %d", aliasType)
+	}
+	buf = buf[n:]
+
+	var tokenType varint.Varint
+	n, err = tokenType.Unmarshal(buf)
+	if err != nil {
+		return 0, err
+	}
+	t.TokenType = uint64(tokenType)
+	t.TokenValue = buf[n:]
+	return llen + int(le), nil
+}
+
+func (t AuthorizationToken) marshalSize() int {
+	n := varint.Varint(t.AliasType).MarshalSize() +
+		varint.Varint(t.TokenType).MarshalSize() +
+		len(t.TokenValue)
+
+	return varint.Varint(n).MarshalSize() + n
+}
+
+func (t AuthorizationToken) marshalTo(buf []byte) int {
+	innerSize := varint.Varint(t.AliasType).MarshalSize() +
+		varint.Varint(t.TokenType).MarshalSize() +
+		len(t.TokenValue)
+	n := varint.Varint(innerSize).MarshalTo(buf)
+	n += varint.Varint(t.AliasType).MarshalTo(buf[n:])
+	n += varint.Varint(t.TokenType).MarshalTo(buf[n:])
+	n += copy(buf[n:], t.TokenValue)
+	return n
+}
diff --git a/internal/protocols/moq/parameter/parameter.go b/internal/protocols/moq/parameter/parameter.go
new file mode 100644
index 00000000..1ec5bfb0
--- /dev/null
+++ b/internal/protocols/moq/parameter/parameter.go
@@ -0,0 +1,91 @@
+// Package parameter contains MoQ parameters.
+package parameter
+
+import (
+	"fmt"
+
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/varint"
+)
+
+// Parameter is a parameter of a control message.
+// spec: draft-18, section 10.2
+type Parameter interface {
+	isParameter()
+	paramType() uint64
+	unmarshal(data []byte) (int, error)
+	marshalSize() int
+	marshalTo(buf []byte) int
+}
+
+// Parameters is a list of parameters.
+type Parameters []Parameter
+
+// Unmarshal decodes parameters. Returns the number of bytes consumed.
+func (p *Parameters) Unmarshal(count int, buf []byte) (int, error) {
+	var currentType uint64
+	total := 0
+
+	for range uint64(count) {
+		var typeDelta varint.Varint
+		n, err := typeDelta.Unmarshal(buf)
+		if err != nil {
+			return 0, err
+		}
+
+		buf = buf[n:]
+		total += n
+		currentType += uint64(typeDelta)
+
+		var param Parameter
+
+		switch currentType {
+		case typeAuthorizationToken:
+			param = &AuthorizationToken{}
+
+		default:
+			return 0, fmt.Errorf("unsupported parameter type: %d", currentType)
+		}
+
+		n, err = param.unmarshal(buf)
+		if err != nil {
+			return 0, fmt.Errorf("failed to unmarshal authorization token: %w", err)
+		}
+
+		*p = append(*p, param)
+		buf = buf[n:]
+		total += n
+	}
+
+	return total, nil
+}
+
+// MarshalSize returns the size of marshaled parameters.
+func (p Parameters) MarshalSize() int {
+	n := 0
+	var prevType uint64
+
+	for _, param := range p {
+		t := param.paramType()
+		delta := t - prevType
+		n += varint.Varint(delta).MarshalSize() + param.marshalSize()
+		prevType = t
+	}
+
+	return n
+}
+
+// MarshalTo encodes parameters.
+func (p Parameters) MarshalTo(buf []byte) int {
+	n := 0
+	var prevType uint64
+
+	for _, param := range p {
+		t := param.paramType()
+		delta := t - prevType
+		n += varint.Varint(delta).MarshalTo(buf[n:])
+		n += param.marshalTo(buf[n:])
+		prevType = t
+	}
+
+	return n
+}
diff --git a/internal/protocols/moq/parameter/parameter_test.go b/internal/protocols/moq/parameter/parameter_test.go
new file mode 100644
index 00000000..022024ba
--- /dev/null
+++ b/internal/protocols/moq/parameter/parameter_test.go
@@ -0,0 +1,60 @@
+package parameter
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+var cases = []struct {
+	name  string
+	count int
+	enc   []byte
+	dec   Parameters
+}{
+	{
+		name:  "no parameters",
+		count: 0,
+		enc:   []byte{},
+		dec:   nil,
+	},
+	{
+		name:  "authorization token",
+		count: 1,
+		enc: []byte{
+			0x03,                               // type delta = 3 (AuthorizationToken)
+			0x08,                               // inner length = 8
+			0x03,                               // alias type = UseValue
+			0x01,                               // token type = 1
+			0x73, 0x65, 0x63, 0x72, 0x65, 0x74, // token value = "secret"
+		},
+		dec: Parameters{
+			&AuthorizationToken{
+				AliasType:  AuthorizationTokenAliasTypeUseValue,
+				TokenType:  1,
+				TokenValue: []byte("secret"),
+			},
+		},
+	},
+}
+
+func TestUnmarshal(t *testing.T) {
+	for _, ca := range cases {
+		t.Run(ca.name, func(t *testing.T) {
+			var params Parameters
+			_, err := params.Unmarshal(ca.count, ca.enc)
+			require.NoError(t, err)
+			require.Equal(t, ca.dec, params)
+		})
+	}
+}
+
+func TestMarshal(t *testing.T) {
+	for _, ca := range cases {
+		t.Run(ca.name, func(t *testing.T) {
+			buf := make([]byte, ca.dec.MarshalSize())
+			ca.dec.MarshalTo(buf)
+			require.Equal(t, ca.enc, buf)
+		})
+	}
+}
diff --git a/internal/protocols/moq/property/property.go b/internal/protocols/moq/property/property.go
new file mode 100644
index 00000000..b1c99ab4
--- /dev/null
+++ b/internal/protocols/moq/property/property.go
@@ -0,0 +1,105 @@
+// Package property contains Media over QUIC object properties.
+package property
+
+import (
+	"fmt"
+
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/varint"
+)
+
+// Property is an object property.
+// spec: draft-18, section 11.2.1.2
+type Property interface {
+	isProperty()
+	propType() varint.Varint
+	unmarshal(buf []byte) (int, error)
+	marshalSize() int
+	marshalTo(buf []byte) int
+}
+
+// Properties are object properties.
+// spec: draft-18, section 11.2.1.2
+type Properties []Property
+
+// Unmarshal decodes properties.
+func (p *Properties) Unmarshal(buf []byte) error {
+	var currentType uint64
+
+	for len(buf) != 0 {
+		var delta varint.Varint
+		n, err := delta.Unmarshal(buf)
+		if err != nil {
+			return err
+		}
+
+		buf = buf[n:]
+		currentType += uint64(delta)
+
+		switch currentType {
+		case timestampPropertyType:
+			var ts Timestamp
+			var n2 int
+			n2, err = ts.unmarshal(buf)
+			if err != nil {
+				return err
+			}
+			*p = append(*p, &ts)
+			buf = buf[n2:]
+
+		default:
+			if currentType%2 == 1 {
+				var length varint.Varint
+				var n2 int
+				n2, err = length.Unmarshal(buf)
+				if err != nil {
+					return err
+				}
+				if len(buf)-n2 < int(length) {
+					return fmt.Errorf("not enough bytes for unknown property")
+				}
+				buf = buf[n2+int(length):]
+			} else {
+				var skip varint.Varint
+				var n2 int
+				n2, err = skip.Unmarshal(buf)
+				if err != nil {
+					return err
+				}
+				buf = buf[n2:]
+			}
+		}
+	}
+
+	return nil
+}
+
+// MarshalSize returns the size of marshaled properties.
+func (p Properties) MarshalSize() int {
+	n := 0
+	var prevType varint.Varint
+
+	for _, prop := range p {
+		t := prop.propType()
+		delta := t - prevType
+		n += delta.MarshalSize() + prop.marshalSize()
+		prevType = t
+	}
+
+	return n
+}
+
+// MarshalTo encodes properties.
+func (p Properties) MarshalTo(buf []byte) int {
+	n := 0
+	var prevType varint.Varint
+
+	for _, prop := range p {
+		t := prop.propType()
+		delta := t - prevType
+		n += delta.MarshalTo(buf[n:])
+		n += prop.marshalTo(buf[n:])
+		prevType = t
+	}
+
+	return n
+}
diff --git a/internal/protocols/moq/property/property_test.go b/internal/protocols/moq/property/property_test.go
new file mode 100644
index 00000000..c4ea7f51
--- /dev/null
+++ b/internal/protocols/moq/property/property_test.go
@@ -0,0 +1,50 @@
+package property
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+var cases = []struct {
+	name string
+	enc  []byte
+	dec  Properties
+}{
+	{
+		name: "no properties",
+		enc:  []byte{},
+		dec:  nil,
+	},
+	{
+		name: "timestamp",
+		enc: []byte{
+			0x06,       // type delta = 6 (Timestamp)
+			0x83, 0xe8, // value = 1000
+		},
+		dec: Properties{
+			new(Timestamp(1000)),
+		},
+	},
+}
+
+func TestUnmarshal(t *testing.T) {
+	for _, ca := range cases {
+		t.Run(ca.name, func(t *testing.T) {
+			var props Properties
+			err := props.Unmarshal(ca.enc)
+			require.NoError(t, err)
+			require.Equal(t, ca.dec, props)
+		})
+	}
+}
+
+func TestMarshal(t *testing.T) {
+	for _, ca := range cases {
+		t.Run(ca.name, func(t *testing.T) {
+			buf := make([]byte, ca.dec.MarshalSize())
+			ca.dec.MarshalTo(buf)
+			require.Equal(t, ca.enc, buf)
+		})
+	}
+}
diff --git a/internal/protocols/moq/property/timestamp.go b/internal/protocols/moq/property/timestamp.go
new file mode 100644
index 00000000..9bfa177f
--- /dev/null
+++ b/internal/protocols/moq/property/timestamp.go
@@ -0,0 +1,33 @@
+package property
+
+import "github.com/bluenviron/mediamtx/internal/protocols/moq/varint"
+
+const timestampPropertyType = 0x06
+
+// Timestamp is the timestamp property.
+// spec: draft-ietf-moq-loc, section 2.3.1.1
+type Timestamp int64
+
+func (t *Timestamp) isProperty() {}
+
+func (Timestamp) propType() varint.Varint {
+	return timestampPropertyType
+}
+
+func (t *Timestamp) unmarshal(buf []byte) (int, error) {
+	var val varint.Varint
+	n, err := val.Unmarshal(buf)
+	if err != nil {
+		return 0, err
+	}
+	*t = Timestamp(val)
+	return n, nil
+}
+
+func (t Timestamp) marshalSize() int {
+	return varint.Varint(t).MarshalSize()
+}
+
+func (t Timestamp) marshalTo(buf []byte) int {
+	return varint.Varint(t).MarshalTo(buf)
+}
diff --git a/internal/protocols/moq/reorderer/reorderer.go b/internal/protocols/moq/reorderer/reorderer.go
new file mode 100644
index 00000000..211b7315
--- /dev/null
+++ b/internal/protocols/moq/reorderer/reorderer.go
@@ -0,0 +1,88 @@
+// Package reorderer contains a subgroup reorderer.
+package reorderer
+
+import (
+	"sync"
+
+	"github.com/bluenviron/mediamtx/internal/logger"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/subgroup"
+)
+
+// Reorderer is a subgroup reorderer.
+type Reorderer struct {
+	MaxReordered int
+	Parent       logger.Writer
+
+	initialized bool
+	mu          sync.Mutex
+	curGroupID  uint64
+	pending     map[uint64]*subgroup.SubGroup
+}
+
+// Initialize initializes the reorderer.
+func (r *Reorderer) Initialize() {
+	r.pending = make(map[uint64]*subgroup.SubGroup)
+}
+
+// Push pushes a subgroup and returns a list of subgroups that are now in order.
+func (r *Reorderer) Push(sg *subgroup.SubGroup) ([]*subgroup.SubGroup, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	if !r.initialized {
+		r.initialized = true
+		r.curGroupID = sg.Header.GroupID
+		return []*subgroup.SubGroup{sg}, nil
+	}
+
+	switch {
+	case sg.Header.GroupID <= r.curGroupID:
+		r.Parent.Log(logger.Warn, "skipping out-of-order subgroup")
+
+	case sg.Header.GroupID == r.curGroupID+1 && len(r.pending) == 0:
+		r.curGroupID = sg.Header.GroupID
+		return []*subgroup.SubGroup{sg}, nil
+
+	default:
+		r.pending[sg.Header.GroupID] = sg
+
+		diff := sg.Header.GroupID - r.curGroupID
+
+		var countInRange uint64
+		for id := range r.pending {
+			if id <= sg.Header.GroupID {
+				countInRange++
+			}
+		}
+
+		if countInRange == diff {
+			return r.flushUpTo(sg.Header.GroupID), nil
+		} else if len(r.pending) > r.MaxReordered {
+			r.Parent.Log(logger.Warn, "too many reordered subgroups, flushing")
+			return r.flushUpTo(sg.Header.GroupID), nil
+		}
+	}
+
+	return nil, nil
+}
+
+func (r *Reorderer) flushUpTo(maxGroupID uint64) []*subgroup.SubGroup {
+	out := make([]*subgroup.SubGroup, 0, len(r.pending))
+	for i := r.curGroupID + 1; i <= maxGroupID; i++ {
+		if e, ok := r.pending[i]; ok {
+			out = append(out, e)
+			delete(r.pending, i)
+		}
+	}
+	r.curGroupID = maxGroupID
+	for {
+		next, ok := r.pending[r.curGroupID+1]
+		if !ok {
+			break
+		}
+		out = append(out, next)
+		delete(r.pending, r.curGroupID+1)
+		r.curGroupID++
+	}
+	return out
+}
diff --git a/internal/protocols/moq/reorderer/reorderer_test.go b/internal/protocols/moq/reorderer/reorderer_test.go
new file mode 100644
index 00000000..4bb7a6f9
--- /dev/null
+++ b/internal/protocols/moq/reorderer/reorderer_test.go
@@ -0,0 +1,163 @@
+package reorderer
+
+import (
+	"testing"
+
+	"github.com/bluenviron/mediamtx/internal/logger"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/subgroup"
+	"github.com/stretchr/testify/require"
+)
+
+type nopLogger struct{}
+
+func (nopLogger) Log(logger.Level, string, ...any) {}
+
+func makeSG(groupID uint64) *subgroup.SubGroup {
+	return &subgroup.SubGroup{
+		Header: subgroup.Header{GroupID: groupID},
+	}
+}
+
+func TestReordererFirstPush(t *testing.T) {
+	r := &Reorderer{MaxReordered: 5, Parent: nopLogger{}}
+	r.Initialize()
+
+	sg0 := makeSG(0)
+	out, err := r.Push(sg0)
+	require.NoError(t, err)
+	require.Equal(t, []*subgroup.SubGroup{sg0}, out)
+}
+
+func TestReordererInOrder(t *testing.T) {
+	r := &Reorderer{MaxReordered: 5, Parent: nopLogger{}}
+	r.Initialize()
+
+	sg0 := makeSG(0)
+	out, err := r.Push(sg0)
+	require.NoError(t, err)
+	require.Equal(t, []*subgroup.SubGroup{sg0}, out)
+
+	sg1 := makeSG(1)
+	out, err = r.Push(sg1)
+	require.NoError(t, err)
+	require.Equal(t, []*subgroup.SubGroup{sg1}, out)
+
+	sg2 := makeSG(2)
+	out, err = r.Push(sg2)
+	require.NoError(t, err)
+	require.Equal(t, []*subgroup.SubGroup{sg2}, out)
+}
+
+func TestReordererStale(t *testing.T) {
+	r := &Reorderer{MaxReordered: 5, Parent: nopLogger{}}
+	r.Initialize()
+
+	sg5 := makeSG(5)
+	out, err := r.Push(sg5)
+	require.NoError(t, err)
+	require.Equal(t, []*subgroup.SubGroup{sg5}, out)
+
+	// same GroupID again
+	out, err = r.Push(makeSG(5))
+	require.NoError(t, err)
+	require.Nil(t, out)
+
+	// older GroupID
+	out, err = r.Push(makeSG(3))
+	require.NoError(t, err)
+	require.Nil(t, out)
+}
+
+func TestReordererOutOfOrderPending(t *testing.T) {
+	r := &Reorderer{MaxReordered: 5, Parent: nopLogger{}}
+	r.Initialize()
+
+	sg0 := makeSG(0)
+	out, err := r.Push(sg0)
+	require.NoError(t, err)
+	require.Equal(t, []*subgroup.SubGroup{sg0}, out)
+
+	// sg2 arrives before sg1; held in pending
+	out, err = r.Push(makeSG(2))
+	require.NoError(t, err)
+	require.Nil(t, out)
+}
+
+func TestReordererOutOfOrderFilled(t *testing.T) {
+	r := &Reorderer{MaxReordered: 5, Parent: nopLogger{}}
+	r.Initialize()
+
+	sg0 := makeSG(0)
+	out, err := r.Push(sg0)
+	require.NoError(t, err)
+	require.Equal(t, []*subgroup.SubGroup{sg0}, out)
+
+	// sg2 arrives out of order, held in pending
+	sg2 := makeSG(2)
+	out, err = r.Push(sg2)
+	require.NoError(t, err)
+	require.Nil(t, out)
+
+	// sg1 (the missing piece) arrives; gap is now filled; sg1 and the
+	// already-pending sg2 are both returned together
+	sg1 := makeSG(1)
+	out, err = r.Push(sg1)
+	require.NoError(t, err)
+	require.Equal(t, []*subgroup.SubGroup{sg1, sg2}, out)
+}
+
+func TestReordererDrainAfterFill(t *testing.T) { //nolint:dupl
+	r := &Reorderer{MaxReordered: 5, Parent: nopLogger{}}
+	r.Initialize()
+
+	sg0 := makeSG(0)
+	out, err := r.Push(sg0)
+	require.NoError(t, err)
+	require.Equal(t, []*subgroup.SubGroup{sg0}, out)
+
+	// sg2 and sg3 arrive before sg1
+	sg2 := makeSG(2)
+	out, err = r.Push(sg2)
+	require.NoError(t, err)
+	require.Nil(t, out)
+
+	sg3 := makeSG(3)
+	out, err = r.Push(sg3)
+	require.NoError(t, err)
+	require.Nil(t, out)
+
+	// sg1 arrives; fills the gap; sg1, sg2, and sg3 are all returned together
+	sg1 := makeSG(1)
+	out, err = r.Push(sg1)
+	require.NoError(t, err)
+	require.Equal(t, []*subgroup.SubGroup{sg1, sg2, sg3}, out)
+}
+
+func TestReordererMaxReordered(t *testing.T) { //nolint:dupl
+	r := &Reorderer{MaxReordered: 2, Parent: nopLogger{}}
+	r.Initialize()
+
+	sg0 := makeSG(0)
+	out, err := r.Push(sg0)
+	require.NoError(t, err)
+	require.Equal(t, []*subgroup.SubGroup{sg0}, out)
+
+	// first out-of-order item (pending=1, not over limit)
+	sg2 := makeSG(2)
+	out, err = r.Push(sg2)
+	require.NoError(t, err)
+	require.Nil(t, out)
+
+	// second out-of-order item (pending=2, not over limit)
+	sg4 := makeSG(4)
+	out, err = r.Push(sg4)
+	require.NoError(t, err)
+	require.Nil(t, out)
+
+	// third out-of-order item pushes pending to 3, which exceeds MaxReordered=2;
+	// all available items are flushed in order, skipping the missing ones (1, 3)
+	sg5 := makeSG(5)
+	out, err = r.Push(sg5)
+	require.NoError(t, err)
+	require.Equal(t, []*subgroup.SubGroup{sg2, sg4, sg5}, out)
+}
diff --git a/internal/protocols/moq/subgroup/header.go b/internal/protocols/moq/subgroup/header.go
new file mode 100644
index 00000000..fdb2953a
--- /dev/null
+++ b/internal/protocols/moq/subgroup/header.go
@@ -0,0 +1,70 @@
+// Package subgroup implements the subgroup stream.
+package subgroup
+
+import (
+	"io"
+
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/varint"
+)
+
+// Header is the SUBGROUP_HEADER structure.
+// spec: draft-18, section 11.4.2
+type Header struct {
+	Properties  bool
+	FirstObject bool
+	TrackAlias  uint64
+	GroupID     uint64
+}
+
+func (h *Header) read(r io.Reader) error {
+	var b [1]byte
+	_, err := r.Read(b[:])
+	if err != nil {
+		return err
+	}
+	h.Properties = (b[0] & 0x01) != 0
+	h.FirstObject = (b[0] & 0x40) != 0
+
+	var trackAlias varint.Varint
+	err = trackAlias.Read(r)
+	if err != nil {
+		return err
+	}
+	h.TrackAlias = uint64(trackAlias)
+
+	var groupID varint.Varint
+	err = groupID.Read(r)
+	if err != nil {
+		return err
+	}
+	h.GroupID = uint64(groupID)
+
+	return nil
+}
+
+func (h Header) marshalSize() int {
+	st := varint.Varint(0x30)
+	if h.Properties {
+		st |= 0x01
+	}
+	if h.FirstObject {
+		st |= 0x40
+	}
+	return st.MarshalSize() +
+		varint.Varint(h.TrackAlias).MarshalSize() +
+		varint.Varint(h.GroupID).MarshalSize()
+}
+
+func (h Header) marshalTo(buf []byte) int {
+	st := varint.Varint(0x30)
+	if h.Properties {
+		st |= 0x01
+	}
+	if h.FirstObject {
+		st |= 0x40
+	}
+	pos := st.MarshalTo(buf)
+	pos += varint.Varint(h.TrackAlias).MarshalTo(buf[pos:])
+	pos += varint.Varint(h.GroupID).MarshalTo(buf[pos:])
+	return pos
+}
diff --git a/internal/protocols/moq/subgroup/object.go b/internal/protocols/moq/subgroup/object.go
new file mode 100644
index 00000000..cfdd00e9
--- /dev/null
+++ b/internal/protocols/moq/subgroup/object.go
@@ -0,0 +1,120 @@
+package subgroup
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/property"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/varint"
+)
+
+const maxPayloadSize = 10 * 1024 * 1024
+
+// Object is an object of a subgroup stream.
+// spec: draft-18, section 11.4.2
+type Object struct {
+	IDDelta    uint64
+	Properties property.Properties
+	Payload    []byte
+}
+
+func (o *Object) read(r io.Reader, header *Header) error {
+	var idDelta varint.Varint
+	if err := idDelta.Read(r); err != nil {
+		return err
+	}
+
+	o.IDDelta = uint64(idDelta)
+
+	if header.Properties {
+		var propsLen varint.Varint
+		err := propsLen.Read(r)
+		if err != nil {
+			return err
+		}
+
+		if propsLen > 0 {
+			props := make([]byte, propsLen)
+			_, err = io.ReadFull(r, props)
+			if err != nil {
+				return err
+			}
+
+			err = o.Properties.Unmarshal(props)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	var payloadLen varint.Varint
+	err := payloadLen.Read(r)
+	if err != nil {
+		return err
+	}
+
+	if payloadLen == 0 {
+		var status varint.Varint
+		if err = status.Read(r); err != nil {
+			return err
+		}
+
+		if status != 0x03 && status != 0x04 {
+			return fmt.Errorf("unexpected status: 0x%x", status)
+		}
+
+		return nil
+	}
+
+	if payloadLen > maxPayloadSize {
+		return fmt.Errorf("payload too large: %d", payloadLen)
+	}
+
+	o.Payload = make([]byte, payloadLen)
+	_, err = io.ReadFull(r, o.Payload)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (o Object) marshalSize(header *Header) int {
+	propsFieldSize := 0
+	if header.Properties {
+		propsLen := o.Properties.MarshalSize()
+		propsFieldSize = varint.Varint(propsLen).MarshalSize() + propsLen
+	}
+
+	if len(o.Payload) == 0 {
+		return varint.Varint(o.IDDelta).MarshalSize() + propsFieldSize + 2
+	}
+
+	return varint.Varint(o.IDDelta).MarshalSize() +
+		propsFieldSize +
+		varint.Varint(len(o.Payload)).MarshalSize() +
+		len(o.Payload)
+}
+
+func (o Object) marshalTo(buf []byte, header *Header) int {
+	n := varint.Varint(o.IDDelta).MarshalTo(buf)
+
+	if header.Properties {
+		propsLen := o.Properties.MarshalSize()
+		n += varint.Varint(propsLen).MarshalTo(buf[n:])
+		n += o.Properties.MarshalTo(buf[n:])
+	}
+
+	if len(o.Payload) == 0 {
+		buf[n] = 0x00
+		n++
+		buf[n] = 0x03
+		n++
+		return n
+	}
+
+	n += varint.Varint(len(o.Payload)).MarshalTo(buf[n:])
+	n += copy(buf[n:], o.Payload)
+
+	return n
+}
diff --git a/internal/protocols/moq/subgroup/subgroup.go b/internal/protocols/moq/subgroup/subgroup.go
new file mode 100644
index 00000000..5681ad95
--- /dev/null
+++ b/internal/protocols/moq/subgroup/subgroup.go
@@ -0,0 +1,70 @@
+package subgroup
+
+import (
+	"fmt"
+	"io"
+)
+
+// SubGroup is a subgroup stream.
+type SubGroup struct {
+	Header  Header
+	Objects []Object
+}
+
+// Read reads a SubGroup.
+func (s *SubGroup) Read(r io.Reader) error {
+	if err := s.Header.read(r); err != nil {
+		return err
+	}
+
+	// for the moment, support reading a single object only.
+
+	var o1 Object
+	err := o1.read(r, &s.Header)
+	if err != nil {
+		return err
+	}
+	s.Objects = []Object{o1}
+
+	var o2 Object
+	err = o2.read(r, &s.Header)
+	if err != nil {
+		return err
+	}
+	if len(o2.Payload) != 0 {
+		return fmt.Errorf("unexpected second object")
+	}
+
+	return nil
+}
+
+func (s SubGroup) marshalSize() int {
+	n := s.Header.marshalSize()
+
+	for _, o := range s.Objects {
+		n += o.marshalSize(&s.Header)
+	}
+
+	n += Object{Payload: nil}.marshalSize(&s.Header)
+
+	return n
+}
+
+func (s SubGroup) marshalTo(buf []byte) int {
+	n := s.Header.marshalTo(buf)
+
+	for _, o := range s.Objects {
+		n += o.marshalTo(buf[n:], &s.Header)
+	}
+
+	n += Object{Payload: nil}.marshalTo(buf[n:], &s.Header)
+
+	return n
+}
+
+// Marshal encodes a SubGroup.
+func (s *SubGroup) Marshal() []byte {
+	buf := make([]byte, s.marshalSize())
+	s.marshalTo(buf)
+	return buf
+}
diff --git a/internal/protocols/moq/subgroup/subgroup_test.go b/internal/protocols/moq/subgroup/subgroup_test.go
new file mode 100644
index 00000000..494a0bef
--- /dev/null
+++ b/internal/protocols/moq/subgroup/subgroup_test.go
@@ -0,0 +1,92 @@
+package subgroup
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/property"
+	"github.com/stretchr/testify/require"
+)
+
+var cases = []struct {
+	name string
+	enc  []byte
+	dec  SubGroup
+}{
+	{
+		name: "stream without properties",
+		enc: []byte{
+			0x30,                         // type (Properties=false, FirstObject=false)
+			0x01,                         // TrackAlias = 1
+			0x00,                         // GroupID = 0
+			0x00,                         // object IDDelta = 0
+			0x05,                         // payload length = 5
+			0x68, 0x65, 0x6c, 0x6c, 0x6f, // payload = "hello"
+			0x00, // end-of-stream IDDelta = 0
+			0x00, // payload length = 0 (end-of-stream)
+			0x03, // status = EndOfGroup
+		},
+		dec: SubGroup{
+			Header: Header{
+				Properties:  false,
+				FirstObject: false,
+				TrackAlias:  1,
+				GroupID:     0,
+			},
+			Objects: []Object{{
+				Payload: []byte("hello"),
+			}},
+		},
+	},
+	{
+		name: "stream with properties",
+		enc: []byte{
+			0x31,       // type (Properties=true)
+			0x01,       // TrackAlias = 1
+			0x00,       // GroupID = 0
+			0x00,       // object IDDelta = 0
+			0x03,       // properties length = 3
+			0x06,       // property type delta = 6 (Timestamp)
+			0x83, 0xe8, // Timestamp value = 1000
+			0x05,                         // payload length = 5
+			0x68, 0x65, 0x6c, 0x6c, 0x6f, // payload = "hello"
+			0x00, // end-of-stream IDDelta = 0
+			0x00, // properties length = 0
+			0x00, // payload length = 0 (end-of-stream)
+			0x03, // status = EndOfGroup
+		},
+		dec: SubGroup{
+			Header: Header{
+				Properties:  true,
+				FirstObject: false,
+				TrackAlias:  1,
+				GroupID:     0,
+			},
+			Objects: []Object{{
+				Properties: property.Properties{
+					new(property.Timestamp(1000)),
+				},
+				Payload: []byte("hello"),
+			}},
+		},
+	},
+}
+
+func TestUnmarshal(t *testing.T) {
+	for _, ca := range cases {
+		t.Run(ca.name, func(t *testing.T) {
+			var s SubGroup
+			err := s.Read(bytes.NewReader(ca.enc))
+			require.NoError(t, err)
+			require.Equal(t, ca.dec, s)
+		})
+	}
+}
+
+func TestMarshal(t *testing.T) {
+	for _, ca := range cases {
+		t.Run(ca.name, func(t *testing.T) {
+			require.Equal(t, ca.enc, ca.dec.Marshal())
+		})
+	}
+}
diff --git a/internal/protocols/moq/to_stream.go b/internal/protocols/moq/to_stream.go
new file mode 100644
index 00000000..e69672c9
--- /dev/null
+++ b/internal/protocols/moq/to_stream.go
@@ -0,0 +1,199 @@
+package moq
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/bluenviron/gortsplib/v5/pkg/description"
+	"github.com/bluenviron/gortsplib/v5/pkg/format"
+	"github.com/bluenviron/mediacommon/v2/pkg/codecs/av1"
+	"github.com/bluenviron/mediacommon/v2/pkg/codecs/h264"
+	"github.com/bluenviron/mediacommon/v2/pkg/codecs/mpeg4audio"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/catalog"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/property"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/subgroup"
+	"github.com/bluenviron/mediamtx/internal/stream"
+	"github.com/bluenviron/mediamtx/internal/unit"
+)
+
+func findTimestamp(props []property.Property) (int64, bool) {
+	for _, pr := range props {
+		if ts, ok := pr.(*property.Timestamp); ok {
+			return int64(*ts), true
+		}
+	}
+	return 0, false
+}
+
+// ToStream maps a Media-over-QUIC stream to a MediaMTX stream.
+func ToStream(
+	cat *catalog.Catalog,
+	subStream **stream.SubStream,
+) (
+	[]*description.Media,
+	map[uint64]func(sg *subgroup.SubGroup) error,
+	error,
+) {
+	var medias []*description.Media
+	writeFuncs := make(map[uint64]func(sg *subgroup.SubGroup) error)
+
+	wrap := func(wrapped func(payload []byte, pts int64) error) func(sg *subgroup.SubGroup) error {
+		return func(sg *subgroup.SubGroup) error {
+			ts, ok := findTimestamp(sg.Objects[0].Properties)
+			if !ok {
+				return fmt.Errorf("timestamp property is required")
+			}
+
+			return wrapped(sg.Objects[0].Payload, ts)
+		}
+	}
+
+	for i, track := range cat.Tracks {
+		trackAlias := uint64(i + 1)
+
+		switch {
+		case strings.HasPrefix(track.Codec, "av01"):
+			forma := &format.AV1{
+				PayloadTyp: 96,
+			}
+			media := &description.Media{
+				Type:    description.MediaTypeVideo,
+				Formats: []format.Format{forma},
+			}
+			medias = append(medias, media)
+
+			writeFuncs[trackAlias] = wrap(func(payload []byte, pts int64) error {
+				var bs av1.Bitstream
+				err := bs.Unmarshal(payload)
+				if err != nil {
+					return err
+				}
+
+				(*subStream).WriteUnit(media, forma, &unit.Unit{PTS: pts, Payload: unit.PayloadAV1(bs)})
+				return nil
+			})
+
+		case strings.HasPrefix(track.Codec, "vp09"):
+			forma := &format.VP9{
+				PayloadTyp: 96,
+			}
+			media := &description.Media{
+				Type:    description.MediaTypeVideo,
+				Formats: []format.Format{forma},
+			}
+			medias = append(medias, media)
+
+			writeFuncs[trackAlias] = wrap(func(payload []byte, pts int64) error {
+				(*subStream).WriteUnit(media, forma, &unit.Unit{PTS: pts, Payload: unit.PayloadVP9(payload)})
+				return nil
+			})
+
+		case track.Codec == "vp8":
+			forma := &format.VP8{
+				PayloadTyp: 96,
+			}
+			media := &description.Media{
+				Type:    description.MediaTypeVideo,
+				Formats: []format.Format{forma},
+			}
+			medias = append(medias, media)
+
+			writeFuncs[trackAlias] = wrap(func(payload []byte, pts int64) error {
+				(*subStream).WriteUnit(media, forma, &unit.Unit{PTS: pts, Payload: unit.PayloadVP8(payload)})
+				return nil
+			})
+		case strings.HasPrefix(track.Codec, "avc3"):
+			forma := &format.H264{
+				PayloadTyp:        96,
+				PacketizationMode: 1,
+			}
+			media := &description.Media{
+				Type:    description.MediaTypeVideo,
+				Formats: []format.Format{forma},
+			}
+			medias = append(medias, media)
+
+			writeFuncs[trackAlias] = wrap(func(payload []byte, pts int64) error {
+				var nalus h264.AVCC
+				err := nalus.Unmarshal(payload)
+				if err != nil {
+					return err
+				}
+
+				(*subStream).WriteUnit(media, forma, &unit.Unit{PTS: pts, Payload: unit.PayloadH264(nalus)})
+				return nil
+			})
+
+		case strings.HasPrefix(track.Codec, "hev1"):
+			forma := &format.H265{
+				PayloadTyp: 96,
+			}
+			media := &description.Media{
+				Type:    description.MediaTypeVideo,
+				Formats: []format.Format{forma},
+			}
+			medias = append(medias, media)
+
+			writeFuncs[trackAlias] = wrap(func(payload []byte, pts int64) error {
+				var nalus h264.AVCC
+				err := nalus.Unmarshal(payload)
+				if err != nil {
+					return err
+				}
+
+				(*subStream).WriteUnit(media, forma, &unit.Unit{PTS: pts, Payload: unit.PayloadH265(nalus)})
+				return nil
+			})
+
+		case track.Codec == "opus":
+			channels := track.Channels
+			if channels == 0 {
+				channels = 2
+			}
+			forma := &format.Opus{
+				PayloadTyp:   96,
+				ChannelCount: channels,
+			}
+			media := &description.Media{
+				Type:    description.MediaTypeAudio,
+				Formats: []format.Format{forma},
+			}
+			medias = append(medias, media)
+
+			writeFuncs[trackAlias] = wrap(func(payload []byte, pts int64) error {
+				(*subStream).WriteUnit(media, forma, &unit.Unit{PTS: pts, Payload: unit.PayloadOpus{payload}})
+				return nil
+			})
+
+		case strings.HasPrefix(track.Codec, "mp4a"):
+			config := &mpeg4audio.AudioSpecificConfig{
+				Type:          mpeg4audio.ObjectTypeAACLC,
+				SampleRate:    track.Samplerate,
+				ChannelConfig: uint8(track.Channels),
+			}
+
+			forma := &format.MPEG4Audio{
+				PayloadTyp:       96,
+				Config:           config,
+				SizeLength:       13,
+				IndexLength:      3,
+				IndexDeltaLength: 3,
+			}
+			media := &description.Media{
+				Type:    description.MediaTypeAudio,
+				Formats: []format.Format{forma},
+			}
+			medias = append(medias, media)
+
+			writeFuncs[trackAlias] = wrap(func(payload []byte, pts int64) error {
+				(*subStream).WriteUnit(media, forma, &unit.Unit{PTS: pts, Payload: unit.PayloadMPEG4Audio{payload}})
+				return nil
+			})
+
+		default:
+			return nil, nil, fmt.Errorf("unsupported codec: %s", track.Codec)
+		}
+	}
+
+	return medias, writeFuncs, nil
+}
diff --git a/internal/protocols/moq/to_stream_test.go b/internal/protocols/moq/to_stream_test.go
new file mode 100644
index 00000000..12cefa10
--- /dev/null
+++ b/internal/protocols/moq/to_stream_test.go
@@ -0,0 +1,69 @@
+package moq
+
+import (
+	"testing"
+
+	"github.com/bluenviron/gortsplib/v5/pkg/description"
+	"github.com/bluenviron/gortsplib/v5/pkg/format"
+	"github.com/bluenviron/mediacommon/v2/pkg/codecs/mpeg4audio"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/catalog"
+	"github.com/stretchr/testify/require"
+)
+
+func TestToStream(t *testing.T) {
+	cat := &catalog.Catalog{
+		Tracks: []catalog.Track{
+			{Codec: "av01.0.04M.08"},
+			{Codec: "vp09.00.10.08"},
+			{Codec: "vp8"},
+			{Codec: "hev1.1.6.L93.B0"},
+			{Codec: "avc3.640028"},
+			{Codec: "opus"},
+			{Codec: "mp4a.40.2", Samplerate: 44100, Channels: 2},
+		},
+	}
+
+	medias, _, err := ToStream(cat, nil)
+	require.NoError(t, err)
+
+	require.Equal(t, []*description.Media{
+		{
+			Type:    description.MediaTypeVideo,
+			Formats: []format.Format{&format.AV1{PayloadTyp: 96}},
+		},
+		{
+			Type:    description.MediaTypeVideo,
+			Formats: []format.Format{&format.VP9{PayloadTyp: 96}},
+		},
+		{
+			Type:    description.MediaTypeVideo,
+			Formats: []format.Format{&format.VP8{PayloadTyp: 96}},
+		},
+		{
+			Type:    description.MediaTypeVideo,
+			Formats: []format.Format{&format.H265{PayloadTyp: 96}},
+		},
+		{
+			Type:    description.MediaTypeVideo,
+			Formats: []format.Format{&format.H264{PayloadTyp: 96, PacketizationMode: 1}},
+		},
+		{
+			Type:    description.MediaTypeAudio,
+			Formats: []format.Format{&format.Opus{PayloadTyp: 96, ChannelCount: 2}},
+		},
+		{
+			Type: description.MediaTypeAudio,
+			Formats: []format.Format{&format.MPEG4Audio{
+				PayloadTyp: 96,
+				Config: &mpeg4audio.AudioSpecificConfig{
+					Type:          mpeg4audio.ObjectTypeAACLC,
+					SampleRate:    44100,
+					ChannelConfig: 2,
+				},
+				SizeLength:       13,
+				IndexLength:      3,
+				IndexDeltaLength: 3,
+			}},
+		},
+	}, medias)
+}
diff --git a/internal/protocols/moq/track.go b/internal/protocols/moq/track.go
new file mode 100644
index 00000000..8c011caa
--- /dev/null
+++ b/internal/protocols/moq/track.go
@@ -0,0 +1,18 @@
+package moq
+
+import (
+	"github.com/bluenviron/gortsplib/v5/pkg/description"
+	"github.com/bluenviron/gortsplib/v5/pkg/format"
+	"github.com/bluenviron/mediamtx/internal/unit"
+)
+
+// Track is a Media-over-QUIC track.
+type Track struct {
+	Codec      string
+	Samplerate int
+	Channels   int
+	InitData   string
+	Media      *description.Media
+	Format     format.Format
+	OnData     func(u *unit.Unit, wrapped func([]byte, int64) error) error
+}
diff --git a/internal/protocols/moq/varint/varint.go b/internal/protocols/moq/varint/varint.go
new file mode 100644
index 00000000..557b935a
--- /dev/null
+++ b/internal/protocols/moq/varint/varint.go
@@ -0,0 +1,245 @@
+// Package varint implements variable-length integers.
+package varint
+
+import (
+	"fmt"
+	"io"
+)
+
+// Varint is a variable-length integer.
+// spec: draft-18, section 1.4.1
+type Varint uint64
+
+// Read reads a Varint from a Reader.
+func (v *Varint) Read(r io.Reader) error {
+	var first [1]byte
+	_, err := io.ReadFull(r, first[:])
+	if err != nil {
+		return err
+	}
+	b := first[0]
+
+	var size int
+	switch {
+	case b&0x80 == 0:
+		*v = Varint(b)
+		return nil
+	case b&0xC0 == 0x80:
+		size = 2
+	case b&0xE0 == 0xC0:
+		size = 3
+	case b&0xF0 == 0xE0:
+		size = 4
+	case b&0xF8 == 0xF0:
+		size = 5
+	case b&0xFC == 0xF8:
+		size = 6
+	case b&0xFE == 0xFC:
+		size = 7
+	case b == 0xFE:
+		size = 8
+	case b == 0xFF:
+		size = 9
+	default:
+		return fmt.Errorf("unsupported varint prefix: 0x%02X", b)
+	}
+
+	rest := make([]byte, size-1)
+	_, err = io.ReadFull(r, rest)
+	if err != nil {
+		return err
+	}
+
+	switch size { //nolint:dupl
+	case 2:
+		*v = Varint(b&0x3F)<<8 | Varint(rest[0])
+	case 3:
+		*v = Varint(b&0x1F)<<16 | Varint(rest[0])<<8 | Varint(rest[1])
+	case 4:
+		*v = Varint(b&0x0F)<<24 | Varint(rest[0])<<16 | Varint(rest[1])<<8 |
+			Varint(rest[2])
+	case 5:
+		*v = Varint(b&0x07)<<32 | Varint(rest[0])<<24 | Varint(rest[1])<<16 |
+			Varint(rest[2])<<8 | Varint(rest[3])
+	case 6:
+		*v = Varint(b&0x03)<<40 | Varint(rest[0])<<32 | Varint(rest[1])<<24 |
+			Varint(rest[2])<<16 | Varint(rest[3])<<8 | Varint(rest[4])
+	case 7:
+		*v = Varint(b&0x01)<<48 | Varint(rest[0])<<40 | Varint(rest[1])<<32 |
+			Varint(rest[2])<<24 | Varint(rest[3])<<16 | Varint(rest[4])<<8 | Varint(rest[5])
+	case 8:
+		*v = Varint(rest[0])<<48 | Varint(rest[1])<<40 | Varint(rest[2])<<32 |
+			Varint(rest[3])<<24 | Varint(rest[4])<<16 | Varint(rest[5])<<8 | Varint(rest[6])
+	default: // 9
+		*v = Varint(rest[0])<<56 | Varint(rest[1])<<48 | Varint(rest[2])<<40 |
+			Varint(rest[3])<<32 | Varint(rest[4])<<24 | Varint(rest[5])<<16 |
+			Varint(rest[6])<<8 | Varint(rest[7])
+	}
+
+	return nil
+}
+
+// Unmarshal decodes a Varinat from a buffer.
+func (v *Varint) Unmarshal(buf []byte) (int, error) {
+	if len(buf) == 0 {
+		return 0, fmt.Errorf("not enough bytes")
+	}
+	b := buf[0]
+
+	var size int
+	switch {
+	case b&0x80 == 0:
+		*v = Varint(b)
+		return 1, nil
+	case b&0xC0 == 0x80:
+		size = 2
+	case b&0xE0 == 0xC0:
+		size = 3
+	case b&0xF0 == 0xE0:
+		size = 4
+	case b&0xF8 == 0xF0:
+		size = 5
+	case b&0xFC == 0xF8:
+		size = 6
+	case b&0xFE == 0xFC:
+		size = 7
+	case b == 0xFE:
+		size = 8
+	case b == 0xFF:
+		size = 9
+	default:
+		return 0, fmt.Errorf("unsupported varint prefix: 0x%02X", b)
+	}
+
+	if len(buf) < size {
+		return 0, fmt.Errorf("not enough bytes")
+	}
+
+	switch size { //nolint:dupl
+	case 2:
+		*v = Varint(b&0x3F)<<8 | Varint(buf[1])
+	case 3:
+		*v = Varint(b&0x1F)<<16 | Varint(buf[1])<<8 | Varint(buf[2])
+	case 4:
+		*v = Varint(b&0x0F)<<24 | Varint(buf[1])<<16 | Varint(buf[2])<<8 |
+			Varint(buf[3])
+	case 5:
+		*v = Varint(b&0x07)<<32 | Varint(buf[1])<<24 | Varint(buf[2])<<16 |
+			Varint(buf[3])<<8 | Varint(buf[4])
+	case 6:
+		*v = Varint(b&0x03)<<40 | Varint(buf[1])<<32 | Varint(buf[2])<<24 |
+			Varint(buf[3])<<16 | Varint(buf[4])<<8 | Varint(buf[5])
+	case 7:
+		*v = Varint(b&0x01)<<48 | Varint(buf[1])<<40 | Varint(buf[2])<<32 |
+			Varint(buf[3])<<24 | Varint(buf[4])<<16 | Varint(buf[5])<<8 | Varint(buf[6])
+	case 8:
+		*v = Varint(buf[1])<<48 | Varint(buf[2])<<40 | Varint(buf[3])<<32 |
+			Varint(buf[4])<<24 | Varint(buf[5])<<16 | Varint(buf[6])<<8 | Varint(buf[7])
+	default: // 9
+		*v = Varint(buf[1])<<56 | Varint(buf[2])<<48 | Varint(buf[3])<<40 |
+			Varint(buf[4])<<32 | Varint(buf[5])<<24 | Varint(buf[6])<<16 |
+			Varint(buf[7])<<8 | Varint(buf[8])
+	}
+
+	return size, nil
+}
+
+// MarshalSize returns the number of bytes required to marshal the Varint.
+func (v Varint) MarshalSize() int {
+	switch {
+	case v < 1<<7:
+		return 1
+	case v < 1<<14:
+		return 2
+	case v < 1<<21:
+		return 3
+	case v < 1<<28:
+		return 4
+	case v < 1<<35:
+		return 5
+	case v < 1<<42:
+		return 6
+	case v < 1<<49:
+		return 7
+	case v < 1<<56:
+		return 8
+	default:
+		return 9
+	}
+}
+
+// MarshalTo encodes the Varint to a buffer.
+func (v Varint) MarshalTo(buf []byte) int {
+	switch {
+	case v < 1<<7:
+		buf[0] = byte(v)
+		return 1
+	case v < 1<<14:
+		buf[0] = 0x80 | byte(v>>8)
+		buf[1] = byte(v)
+		return 2
+	case v < 1<<21:
+		buf[0] = 0xC0 | byte(v>>16)
+		buf[1] = byte(v >> 8)
+		buf[2] = byte(v)
+		return 3
+	case v < 1<<28:
+		buf[0] = 0xE0 | byte(v>>24)
+		buf[1] = byte(v >> 16)
+		buf[2] = byte(v >> 8)
+		buf[3] = byte(v)
+		return 4
+	case v < 1<<35:
+		buf[0] = 0xF0 | byte(v>>32)
+		buf[1] = byte(v >> 24)
+		buf[2] = byte(v >> 16)
+		buf[3] = byte(v >> 8)
+		buf[4] = byte(v)
+		return 5
+	case v < 1<<42:
+		buf[0] = 0xF8 | byte(v>>40)
+		buf[1] = byte(v >> 32)
+		buf[2] = byte(v >> 24)
+		buf[3] = byte(v >> 16)
+		buf[4] = byte(v >> 8)
+		buf[5] = byte(v)
+		return 6
+	case v < 1<<49:
+		buf[0] = 0xFC | byte(v>>48)
+		buf[1] = byte(v >> 40)
+		buf[2] = byte(v >> 32)
+		buf[3] = byte(v >> 24)
+		buf[4] = byte(v >> 16)
+		buf[5] = byte(v >> 8)
+		buf[6] = byte(v)
+		return 7
+	case v < 1<<56:
+		buf[0] = 0xFE
+		buf[1] = byte(v >> 48)
+		buf[2] = byte(v >> 40)
+		buf[3] = byte(v >> 32)
+		buf[4] = byte(v >> 24)
+		buf[5] = byte(v >> 16)
+		buf[6] = byte(v >> 8)
+		buf[7] = byte(v)
+		return 8
+	default:
+		buf[0] = 0xFF
+		buf[1] = byte(v >> 56)
+		buf[2] = byte(v >> 48)
+		buf[3] = byte(v >> 40)
+		buf[4] = byte(v >> 32)
+		buf[5] = byte(v >> 24)
+		buf[6] = byte(v >> 16)
+		buf[7] = byte(v >> 8)
+		buf[8] = byte(v)
+		return 9
+	}
+}
+
+// Marshal encodes the Varint to bytes.
+func (v Varint) Marshal() []byte {
+	buf := make([]byte, v.MarshalSize())
+	v.MarshalTo(buf)
+	return buf
+}
diff --git a/internal/protocols/moq/varint/varint_test.go b/internal/protocols/moq/varint/varint_test.go
new file mode 100644
index 00000000..75b8af81
--- /dev/null
+++ b/internal/protocols/moq/varint/varint_test.go
@@ -0,0 +1,91 @@
+package varint
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+var cases = []struct {
+	name string
+	enc  []byte
+	dec  Varint
+}{
+	{
+		name: "1 byte",
+		enc:  []byte{0x00},
+		dec:  0,
+	},
+	{
+		name: "2 bytes",
+		enc:  []byte{0x83, 0xe8},
+		dec:  1000,
+	},
+	{
+		name: "3 bytes",
+		enc:  []byte{0xc0, 0x40, 0x00},
+		dec:  16384,
+	},
+	{
+		name: "4 bytes",
+		enc:  []byte{0xe0, 0x20, 0x00, 0x00},
+		dec:  2097152,
+	},
+	{
+		name: "5 bytes",
+		enc:  []byte{0xf0, 0x10, 0x00, 0x00, 0x00},
+		dec:  268435456,
+	},
+	{
+		name: "6 bytes",
+		enc:  []byte{0xf8, 0x08, 0x00, 0x00, 0x00, 0x00},
+		dec:  34359738368,
+	},
+	{
+		name: "7 bytes",
+		enc:  []byte{0xfc, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00},
+		dec:  4398046511104,
+	},
+	{
+		name: "8 bytes",
+		enc:  []byte{0xfe, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
+		dec:  562949953421312,
+	},
+	{
+		name: "9 bytes",
+		enc:  []byte{0xff, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
+		dec:  72057594037927936,
+	},
+}
+
+func TestRead(t *testing.T) {
+	for _, ca := range cases {
+		t.Run(ca.name, func(t *testing.T) {
+			var v Varint
+			err := v.Read(bytes.NewReader(ca.enc))
+			require.NoError(t, err)
+			require.Equal(t, ca.dec, v)
+		})
+	}
+}
+
+func TestUnmarshal(t *testing.T) {
+	for _, ca := range cases {
+		t.Run(ca.name, func(t *testing.T) {
+			var v Varint
+			n, err := v.Unmarshal(ca.enc)
+			require.NoError(t, err)
+			require.Equal(t, len(ca.enc), n)
+			require.Equal(t, ca.dec, v)
+		})
+	}
+}
+
+func TestMarshal(t *testing.T) {
+	for _, ca := range cases {
+		t.Run(ca.name, func(t *testing.T) {
+			require.Equal(t, ca.enc, ca.dec.Marshal())
+		})
+	}
+}
diff --git a/internal/servers/hls/http_server.go b/internal/servers/hls/http_server.go
index ca313a12..f078cc70 100644
--- a/internal/servers/hls/http_server.go
+++ b/internal/servers/hls/http_server.go
@@ -77,9 +77,7 @@ type httpServer struct {
 func (s *httpServer) initialize() error {
 	router := gin.New()
 	router.SetTrustedProxies(s.trustedProxies.ToTrustedProxies()) //nolint:errcheck
-
 	router.Use(s.middlewarePreflightRequests)
-
 	router.Use(s.onRequest)
 
 	var proto string
diff --git a/internal/servers/hls/index.html b/internal/servers/hls/index.html
index c07446d2..d34678f8 100644
--- a/internal/servers/hls/index.html
+++ b/internal/servers/hls/index.html
@@ -75,13 +75,13 @@
     <script defer src="hls.min.js"></script>
 
     <script>
-      const retryPause = 2000;
-
       const video = document.getElementById("video");
       const message = document.getElementById("message");
       const langIcon = document.getElementById("lang-icon");
       const langList = document.getElementById("lang-list");
 
+      const retryPause = 2000;
+
       let defaultControls = false;
 
       const setMessage = (str) => {
diff --git a/internal/servers/hls/server.go b/internal/servers/hls/server.go
index 7dea263d..3c32c471 100644
--- a/internal/servers/hls/server.go
+++ b/internal/servers/hls/server.go
@@ -181,7 +181,7 @@ func (s *Server) Initialize() error {
 		return err
 	}
 
-	str := "listener opened on " + s.Address
+	str := "started with listener on " + s.Address
 	if !s.Encryption {
 		str += " (TCP/HTTP)"
 	} else {
@@ -206,7 +206,7 @@ func (s *Server) Log(level logger.Level, format string, args ...any) {
 
 // Close closes the server.
 func (s *Server) Close() {
-	s.Log(logger.Info, "listener is closing")
+	s.Log(logger.Info, "closing")
 
 	if !interfaceIsEmpty(s.Metrics) {
 		s.Metrics.SetHLSServer(nil)
diff --git a/internal/servers/moq/http_server.go b/internal/servers/moq/http_server.go
new file mode 100644
index 00000000..bb1a7924
--- /dev/null
+++ b/internal/servers/moq/http_server.go
@@ -0,0 +1,342 @@
+package moq
+
+import (
+	"crypto/sha256"
+	"crypto/tls"
+	_ "embed"
+	"encoding/base64"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"path"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/bluenviron/mediamtx/internal/auth"
+	"github.com/bluenviron/mediamtx/internal/conf"
+	"github.com/bluenviron/mediamtx/internal/defs"
+	"github.com/bluenviron/mediamtx/internal/logger"
+	"github.com/bluenviron/mediamtx/internal/protocols/httpp"
+	"github.com/bluenviron/mediamtx/internal/protocols/httpp3"
+)
+
+//go:embed publish_index.html
+var publishIndex []byte
+
+//go:embed read_index.html
+var readIndex []byte
+
+//go:embed reader.js
+var readerJS []byte
+
+//go:embed publisher.js
+var publisherJS []byte
+
+const (
+	moqtVersion                = "moqt-18"
+	wtProtocolHeader           = "WT-Protocol"
+	wtAvailableProtocolsHeader = "WT-Available-Protocols"
+)
+
+type ginUnwrapper interface {
+	Unwrap() http.ResponseWriter
+}
+
+func containsMoqtVersion(header string) bool {
+	for item := range strings.SplitSeq(header, ",") {
+		item = strings.TrimSpace(item)
+		if i := strings.IndexByte(item, ';'); i >= 0 {
+			item = item[:i]
+		}
+		item = strings.Trim(strings.TrimSpace(item), `"`)
+		if item == moqtVersion {
+			return true
+		}
+	}
+	return false
+}
+
+func trailingSlashLocation(rawPath string, rawQuery string) string {
+	res := path.Clean(rawPath)
+	res = strings.TrimLeft(res, "/\\")
+	res = "/" + res + "/"
+
+	if rawQuery != "" {
+		res += "?" + rawQuery
+	}
+
+	return res
+}
+
+func certFingerprint(cert *tls.Certificate) (string, error) {
+	if len(cert.Certificate) == 0 {
+		return "", fmt.Errorf("empty certificate")
+	}
+	sum := sha256.Sum256(cert.Certificate[0])
+	return hex.EncodeToString(sum[:]), nil
+}
+
+type httpServerParent interface {
+	newSession(req newSessionReq) newSessionRes
+	logger.Writer
+}
+
+type httpServer struct {
+	https2Address     string
+	https3Address     string
+	serverCert        string
+	serverKey         string
+	allowOrigins      []string
+	trustedProxies    conf.IPNetworks
+	udpReadBufferSize uint
+	readTimeout       conf.Duration
+	writeTimeout      conf.Duration
+	pathManager       serverPathManager
+	parent            httpServerParent
+
+	innerHTTPS2 *httpp.Server
+	innerHTTPS3 *httpp3.Server
+}
+
+func (s *httpServer) initialize() error {
+	routerHTTPS2 := gin.New()
+	routerHTTPS2.SetTrustedProxies(s.trustedProxies.ToTrustedProxies()) //nolint:errcheck
+	routerHTTPS2.Use(s.middlewarePreflightRequests)
+	routerHTTPS2.Use(s.onRequestHTTPS2)
+
+	s.innerHTTPS2 = &httpp.Server{
+		Address:       s.https2Address,
+		AllowOrigins:  s.allowOrigins,
+		ReadTimeout:   time.Duration(s.readTimeout),
+		WriteTimeout:  time.Duration(s.writeTimeout),
+		Encryption:    true,
+		ServerKey:     s.serverKey,
+		ServerCert:    s.serverCert,
+		AllowAutoCert: true,
+		Handler:       routerHTTPS2,
+		Parent:        s,
+	}
+	err := s.innerHTTPS2.Initialize()
+	if err != nil {
+		return err
+	}
+
+	routerHTTPS3 := gin.New()
+	routerHTTPS3.Use(s.onRequestHTTPS3)
+
+	s.innerHTTPS3 = &httpp3.Server{
+		Address:            s.https3Address,
+		UDPReadBufferSize:  s.udpReadBufferSize,
+		EnableWebTransport: true,
+		Handler:            routerHTTPS3,
+		Parent:             s,
+	}
+	err = s.innerHTTPS3.Initialize()
+	if err != nil {
+		s.innerHTTPS2.Close()
+		return err
+	}
+
+	return nil
+}
+
+// Log implements logger.Writer.
+func (s *httpServer) Log(level logger.Level, format string, args ...any) {
+	s.parent.Log(level, format, args...)
+}
+
+func (s *httpServer) close() {
+	s.innerHTTPS3.Close()
+	s.innerHTTPS2.Close()
+}
+
+func (s *httpServer) middlewarePreflightRequests(ctx *gin.Context) {
+	if ctx.Request.Method == http.MethodOptions &&
+		ctx.Request.Header.Get("Access-Control-Request-Method") != "" {
+		ctx.Header("Access-Control-Allow-Methods", "OPTIONS, GET, POST")
+		ctx.AbortWithStatus(http.StatusNoContent)
+		return
+	}
+}
+
+func (s *httpServer) writeErrorNoLog(ctx *gin.Context, status int, err error) {
+	ctx.AbortWithStatusJSON(status, &defs.APIError{
+		Status: defs.APIErrorStatusError,
+		Error:  err.Error(),
+	})
+}
+
+func (s *httpServer) checkAuthOutsideSession(ctx *gin.Context, pathName string, publish bool) bool {
+	_, err := s.pathManager.FindPathConf(defs.PathFindPathConfReq{
+		AccessRequest: defs.PathAccessRequest{
+			Name:        pathName,
+			Query:       ctx.Request.URL.RawQuery,
+			Publish:     publish,
+			Proto:       auth.ProtocolMoQ,
+			Credentials: httpp.Credentials(ctx.Request),
+			IP:          net.ParseIP(ctx.ClientIP()),
+		},
+	})
+	if err != nil {
+		var terr *auth.Error
+		if errors.As(err, &terr) {
+			if terr.AskCredentials {
+				ctx.Header("WWW-Authenticate", `Basic realm="mediamtx"`)
+				s.writeErrorNoLog(ctx, http.StatusUnauthorized, fmt.Errorf("authentication error"))
+				return false
+			}
+
+			s.Log(logger.Info, "connection %v failed to authenticate: %v", httpp.RemoteAddr(ctx), terr.Wrapped)
+
+			// wait some seconds to delay brute force attacks
+			<-time.After(auth.PauseAfterError)
+
+			s.writeErrorNoLog(ctx, http.StatusUnauthorized, fmt.Errorf("authentication error"))
+			return false
+		}
+
+		s.writeErrorNoLog(ctx, http.StatusInternalServerError, err)
+		return false
+	}
+
+	return true
+}
+
+func (s *httpServer) onPage(ctx *gin.Context, pathName string, publish bool) {
+	if !s.checkAuthOutsideSession(ctx, pathName, publish) {
+		return
+	}
+
+	ctx.Header("Content-Type", "text/html")
+	ctx.Writer.WriteHeader(http.StatusOK)
+
+	if publish {
+		ctx.Writer.Write(publishIndex)
+	} else {
+		ctx.Writer.Write(readIndex)
+	}
+}
+
+func (s *httpServer) onAuthMirror(ctx *gin.Context) {
+	if !strings.HasPrefix(ctx.Request.Header.Get("Authorization"), "Basic ") {
+		s.writeErrorNoLog(ctx, http.StatusBadRequest, fmt.Errorf("missing basic auth header"))
+		return
+	}
+
+	creds, err := base64.StdEncoding.DecodeString(ctx.Request.Header.Get("Authorization")[len("Basic "):])
+	if err != nil {
+		s.writeErrorNoLog(ctx, http.StatusBadRequest, fmt.Errorf("invalid basic auth header: %w", err))
+		return
+	}
+
+	parts := strings.SplitN(string(creds), ":", 2)
+	if len(parts) != 2 {
+		s.writeErrorNoLog(ctx, http.StatusBadRequest, fmt.Errorf("invalid basic auth header: missing colon"))
+		return
+	}
+
+	ctx.JSON(http.StatusOK, struct {
+		User string `json:"user"`
+		Pass string `json:"pass"`
+	}{
+		User: parts[0],
+		Pass: parts[1],
+	})
+}
+
+func (s *httpServer) onFingerprint(ctx *gin.Context) {
+	fp, err := certFingerprint(s.innerHTTPS3.Certificate())
+	if err != nil {
+		s.writeErrorNoLog(ctx, http.StatusInternalServerError, err)
+		return
+	}
+
+	ctx.String(http.StatusOK, fp)
+}
+
+func (s *httpServer) onRequestHTTPS2(ctx *gin.Context) {
+	if ctx.Request.Method == http.MethodGet {
+		switch {
+		case strings.HasSuffix(ctx.Request.URL.Path, "/authmirror"):
+			s.onAuthMirror(ctx)
+
+		case strings.HasSuffix(ctx.Request.URL.Path, "/fingerprint"):
+			s.onFingerprint(ctx)
+
+		case strings.HasSuffix(ctx.Request.URL.Path, "/reader.js"):
+			ctx.Header("Cache-Control", "max-age=3600")
+			ctx.Header("Content-Type", "application/javascript")
+			ctx.Writer.WriteHeader(http.StatusOK)
+			ctx.Writer.Write(readerJS)
+
+		case strings.HasSuffix(ctx.Request.URL.Path, "/publisher.js"):
+			ctx.Header("Cache-Control", "max-age=3600")
+			ctx.Header("Content-Type", "application/javascript")
+			ctx.Writer.WriteHeader(http.StatusOK)
+			ctx.Writer.Write(publisherJS)
+
+		case ctx.Request.URL.Path == "/favicon.ico":
+
+		case len(ctx.Request.URL.Path) >= 2:
+			switch {
+			case len(ctx.Request.URL.Path) > len("/publish") && strings.HasSuffix(ctx.Request.URL.Path, "/publish"):
+				s.onPage(ctx, ctx.Request.URL.Path[1:len(ctx.Request.URL.Path)-len("/publish")], true)
+
+			case ctx.Request.URL.Path[len(ctx.Request.URL.Path)-1] != '/':
+				ctx.Header("Location", trailingSlashLocation(ctx.Request.URL.Path, ctx.Request.URL.RawQuery))
+				ctx.Writer.WriteHeader(http.StatusFound)
+
+			default:
+				s.onPage(ctx, ctx.Request.URL.Path[1:len(ctx.Request.URL.Path)-1], false)
+			}
+		}
+	}
+}
+
+func (s *httpServer) onRequestHTTPS3(ctx *gin.Context) {
+	if ctx.Request.Method != http.MethodConnect ||
+		!strings.HasSuffix(ctx.Request.URL.Path, "/moq") ||
+		len(ctx.Request.URL.Path) <= len("/moq") {
+		return
+	}
+
+	pathName := ctx.Request.URL.Path[1 : len(ctx.Request.URL.Path)-len("/moq")]
+	if len(pathName) == 0 {
+		return
+	}
+
+	if offered := ctx.Request.Header.Get(wtAvailableProtocolsHeader); offered != "" {
+		if !containsMoqtVersion(offered) {
+			s.writeErrorNoLog(ctx, http.StatusBadRequest,
+				fmt.Errorf("no supported MoQ version in %s", wtAvailableProtocolsHeader))
+			return
+		}
+	}
+
+	w := ctx.Writer.(ginUnwrapper).Unwrap()
+
+	if offered := ctx.Request.Header.Get(wtAvailableProtocolsHeader); offered != "" {
+		w.Header().Set(wtProtocolHeader, `"`+moqtVersion+`"`)
+	}
+
+	wt, err := s.innerHTTPS3.Upgrade(w, ctx.Request)
+	if err != nil {
+		s.writeErrorNoLog(ctx, http.StatusBadRequest, fmt.Errorf("webtransport upgrade failed: %w", err))
+		return
+	}
+
+	res := s.parent.newSession(newSessionReq{
+		pathName:  pathName,
+		query:     ctx.Request.URL.RawQuery,
+		userAgent: ctx.Request.Header.Get("User-Agent"),
+		wt:        wt,
+	})
+	if res.err != nil {
+		wt.CloseWithError(0, res.err.Error()) //nolint:errcheck
+		return
+	}
+}
diff --git a/internal/servers/moq/inbound_track.go b/internal/servers/moq/inbound_track.go
new file mode 100644
index 00000000..f80bfda3
--- /dev/null
+++ b/internal/servers/moq/inbound_track.go
@@ -0,0 +1,38 @@
+package moq
+
+import (
+	"github.com/bluenviron/mediamtx/internal/logger"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/reorderer"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/subgroup"
+)
+
+type inboundTrack struct {
+	onSubGroup func(sg *subgroup.SubGroup) error
+	parent     logger.Writer
+
+	reorderer *reorderer.Reorderer
+}
+
+func (t *inboundTrack) initialize() {
+	t.reorderer = &reorderer.Reorderer{
+		MaxReordered: maxReorderedSubGroups,
+		Parent:       t.parent,
+	}
+	t.reorderer.Initialize()
+}
+
+func (t *inboundTrack) push(sg *subgroup.SubGroup) error {
+	sgs, err := t.reorderer.Push(sg)
+	if err != nil {
+		return err
+	}
+
+	for _, s := range sgs {
+		err = t.onSubGroup(s)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/internal/servers/moq/publish_index.html b/internal/servers/moq/publish_index.html
new file mode 100644
index 00000000..8f180ce3
--- /dev/null
+++ b/internal/servers/moq/publish_index.html
@@ -0,0 +1,480 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width" />
+    <style>
+      html,
+      body {
+        margin: 0;
+        padding: 0;
+        height: 100%;
+        font-family: "Arial", sans-serif;
+      }
+      #video {
+        position: absolute;
+        top: 0;
+        left: 0;
+        width: 100%;
+        height: 100%;
+        background: rgb(30, 30, 30);
+      }
+      #controls {
+        display: none;
+        flex-shrink: 0;
+        align-items: center;
+        justify-content: center;
+        padding: 10px;
+        flex-direction: column;
+        min-height: 100%;
+        width: 100%;
+        box-sizing: border-box;
+        background: rgb(30, 30, 30);
+        color: white;
+      }
+      .item {
+        display: grid;
+        grid-auto-flow: column;
+        grid-template-columns: auto 220px;
+        align-items: center;
+        gap: 20px;
+        max-width: 500px;
+        margin: 10px 0;
+      }
+      select,
+      input[type="text"] {
+        appearance: none;
+        background: inherit;
+        color: inherit;
+        border: 1px solid rgb(200, 200, 200);
+        border-radius: 3px;
+        height: 40px;
+        padding: 0 10px;
+      }
+      select option {
+        color: black;
+      }
+      #message {
+        position: absolute;
+        left: 0;
+        top: 0;
+        width: 100%;
+        height: 100%;
+        display: flex;
+        align-items: center;
+        text-align: center;
+        justify-content: center;
+        font-size: 16px;
+        font-weight: bold;
+        color: white;
+        pointer-events: none;
+        padding: 20px;
+        box-sizing: border-box;
+        text-shadow: 0 0 5px black;
+      }
+      #publish-button {
+        margin-top: 10px;
+        appearance: none;
+        background: rgb(200, 200, 200);
+        color: black;
+        border-radius: 3px;
+        height: 50px;
+        padding: 0 20px;
+        border: none;
+      }
+    </style>
+    <script defer src="./publisher.js"></script>
+  </head>
+  <body>
+    <video id="video" muted autoplay playsinline></video>
+
+    <div id="controls">
+      <div id="items">
+        <div class="item">
+          <label for="video-device">video device</label>
+          <select id="video-device">
+            <option value="none">none</option>
+          </select>
+        </div>
+
+        <div class="item">
+          <label for="video-codec">video codec</label>
+          <select id="video-codec"></select>
+        </div>
+
+        <div class="item">
+          <label for="video-bitrate">video bitrate (kbps)</label>
+          <input id="video-bitrate" type="text" value="10000" />
+        </div>
+
+        <div class="item">
+          <label for="video-framerate">video framerate (ideal)</label>
+          <input id="video-framerate" type="text" value="30" />
+        </div>
+
+        <div class="item">
+          <label for="video-keyframe-interval">video keyframe interval</label>
+          <input id="video-keyframe-interval" type="text" value="60" />
+        </div>
+
+        <div class="item">
+          <label for="video-width">video width (ideal)</label>
+          <input id="video-width" type="text" value="1920" />
+        </div>
+
+        <div class="item">
+          <label for="video-height">video height (ideal)</label>
+          <input id="video-height" type="text" value="1080" />
+        </div>
+
+        <div class="item">
+          <label for="audio-device">audio device</label>
+          <select id="audio-device">
+            <option value="none">none</option>
+          </select>
+        </div>
+
+        <div class="item">
+          <label for="audio-codec">audio codec</label>
+          <select id="audio-codec"></select>
+        </div>
+
+        <div class="item">
+          <label for="audio-bitrate">audio bitrate (kbps)</label>
+          <input id="audio-bitrate" type="text" value="128" />
+        </div>
+
+        <div class="item">
+          <label for="audio-voice">optimize for voice</label>
+          <div>
+            <input id="audio-voice" type="checkbox" checked />
+          </div>
+        </div>
+      </div>
+
+      <div id="submit-line">
+        <button id="publish-button">publish</button>
+      </div>
+    </div>
+
+    <div id="message"></div>
+
+    <script>
+      const video = document.getElementById("video");
+      const controls = document.getElementById("controls");
+      const message = document.getElementById("message");
+      const publishButton = document.getElementById("publish-button");
+
+      const videoForm = {
+        device: document.getElementById("video-device"),
+        codec: document.getElementById("video-codec"),
+        bitrate: document.getElementById("video-bitrate"),
+        framerate: document.getElementById("video-framerate"),
+        keyframeInterval: document.getElementById("video-keyframe-interval"),
+        width: document.getElementById("video-width"),
+        height: document.getElementById("video-height"),
+      };
+
+      const audioForm = {
+        device: document.getElementById("audio-device"),
+        codec: document.getElementById("audio-codec"),
+        bitrate: document.getElementById("audio-bitrate"),
+        voice: document.getElementById("audio-voice"),
+      };
+
+      let publisher = null;
+      let creds = null;
+
+      const setMessage = (str) => {
+        message.innerText = str;
+      };
+
+      const onStream = (stream) => {
+        video.srcObject = stream;
+
+        publisher = new MediaMTXMoQPublisher({
+          fingerprintUrl: new URL("fingerprint", window.location.href),
+          url: new URL("moq", window.location.href) + window.location.search,
+          user: creds?.user,
+          pass: creds?.pass,
+          stream,
+          videoCodec: videoForm.codec.value,
+          videoBitrate: videoForm.bitrate.value,
+          videoFramerate: videoForm.framerate.value,
+          videoKeyframeInterval: videoForm.keyframeInterval.value,
+          videoWidth: videoForm.width.value,
+          videoHeight: videoForm.height.value,
+          audioCodec: audioForm.codec.value,
+          audioBitrate: audioForm.bitrate.value,
+          onError: (err) => {
+            setMessage(err);
+          },
+          onConnected: () => {
+            setMessage("");
+          },
+        });
+      };
+
+      const onPublish = () => {
+        controls.style.display = "none";
+        video.style.display = "block";
+        setMessage("connecting");
+
+        const videoId = videoForm.device.value;
+        const audioId = audioForm.device.value;
+
+        let mediaPromise;
+
+        if (videoId !== "screen") {
+          let videoOpts = false;
+
+          if (videoId !== "none") {
+            videoOpts = {
+              deviceId: videoId,
+              width: { ideal: videoForm.width.value },
+              height: { ideal: videoForm.height.value },
+              frameRate: { ideal: videoForm.framerate.value },
+            };
+          }
+
+          let audioOpts = false;
+
+          if (audioId !== "none") {
+            audioOpts = { deviceId: audioId };
+
+            if (!audioForm.voice.checked) {
+              audioOpts.autoGainControl = false;
+              audioOpts.echoCancellation = false;
+              audioOpts.noiseSuppression = false;
+            }
+          }
+
+          mediaPromise = navigator.mediaDevices.getUserMedia({
+            video: videoOpts,
+            audio: audioOpts,
+          });
+        } else {
+          mediaPromise = navigator.mediaDevices.getDisplayMedia({
+            video: {
+              width: { ideal: videoForm.width.value },
+              height: { ideal: videoForm.height.value },
+              frameRate: { ideal: videoForm.framerate.value },
+              cursor: "always",
+            },
+            audio: true,
+          });
+        }
+
+        mediaPromise
+          .then((stream) => onStream(stream))
+          .catch((err) => {
+            setMessage(err.toString());
+          });
+      };
+
+      const selectHasOption = (select, option) => {
+        for (const opt of select.querySelectorAll("option")) {
+          if (opt.value === option) {
+            return true;
+          }
+        }
+        return false;
+      };
+
+      const populateDevices = () => {
+        return navigator.mediaDevices.enumerateDevices().then((devices) => {
+          for (const device of devices) {
+            if (device.kind === "videoinput" || device.kind === "audioinput") {
+              const select =
+                device.kind === "videoinput"
+                  ? videoForm.device
+                  : audioForm.device;
+
+              if (!selectHasOption(select, device.deviceId)) {
+                const opt = document.createElement("option");
+                opt.value = device.deviceId;
+                opt.text = device.label;
+                select.appendChild(opt);
+              }
+            }
+          }
+
+          if (navigator.mediaDevices.getDisplayMedia !== undefined) {
+            const opt = document.createElement("option");
+            opt.value = "screen";
+            opt.text = "screen";
+            videoForm.device.appendChild(opt);
+          }
+
+          if (videoForm.device.children.length !== 0) {
+            videoForm.device.value = videoForm.device.children[1].value;
+          }
+
+          if (audioForm.device.children.length !== 0) {
+            audioForm.device.value = audioForm.device.children[1].value;
+          }
+        });
+      };
+
+      const populateCodecs = async () => {
+        const videoCodecCandidates = [
+          { codec: "av01.0.04M.08", label: "AV1" },
+          { codec: "vp09.00.10.08", label: "VP9" },
+          { codec: "vp8", label: "VP8" },
+          { codec: "avc3.640028", label: "H264" },
+          { codec: "hev1.1.6.L93.B0", label: "H265" },
+        ];
+
+        for (const { codec, label } of videoCodecCandidates) {
+          try {
+            const result = await VideoEncoder.isConfigSupported({
+              codec,
+              width: 1280,
+              height: 720,
+              bitrate: 5000000,
+              framerate: 30,
+            });
+            if (result.supported) {
+              const opt = document.createElement("option");
+              opt.value = codec;
+              opt.text = label;
+              videoForm.codec.appendChild(opt);
+            }
+          } catch (e) {}
+        }
+
+        const audioCodecCandidates = [
+          { codec: "opus", label: "OPUS" },
+          { codec: "mp4a.40.2", label: "AAC" },
+        ];
+
+        for (const { codec, label } of audioCodecCandidates) {
+          try {
+            const result = await AudioEncoder.isConfigSupported({
+              codec,
+              sampleRate: 48000,
+              numberOfChannels: 2,
+              bitrate: 128000,
+            });
+            if (result.supported) {
+              const opt = document.createElement("option");
+              opt.value = codec;
+              opt.text = label;
+              audioForm.codec.appendChild(opt);
+            }
+          } catch (e) {}
+        }
+      };
+
+      const loadDevices = () => {
+        setMessage("loading devices");
+
+        return navigator.mediaDevices
+          .getUserMedia({ video: true, audio: true })
+          .then((tempStream) => {
+            return Promise.all([populateDevices(), populateCodecs()]).then(
+              () => {
+                // free the webcam to prevent 'NotReadableError' on Android
+                tempStream.getTracks().forEach((track) => track.stop());
+              },
+            );
+          });
+      };
+
+      const setupEventListeners = () => {
+        const url = new URL(window.location.href);
+        const inputs = [
+          ...Object.values(videoForm),
+          ...Object.values(audioForm),
+        ];
+
+        for (const input of inputs) {
+          if (input instanceof HTMLInputElement && input.type === "text") {
+            input.addEventListener("input", () => {
+              url.searchParams.set(input.id, input.value);
+              window.history.replaceState(null, null, url);
+            });
+          }
+
+          if (input instanceof HTMLInputElement && input.type === "checkbox") {
+            input.addEventListener("input", () => {
+              url.searchParams.set(input.id, input.checked);
+              window.history.replaceState(null, null, url);
+            });
+          }
+
+          if (input instanceof HTMLSelectElement) {
+            input.addEventListener("input", () => {
+              url.searchParams.set(input.id, input.value);
+              window.history.replaceState(null, null, url);
+            });
+          }
+        }
+      };
+
+      const loadValuesFromQuery = () => {
+        const params = new URLSearchParams(window.location.search);
+        const inputs = [
+          ...Object.values(videoForm),
+          ...Object.values(audioForm),
+        ];
+
+        for (const input of inputs) {
+          const value = params.get(input.id);
+          if (value) {
+            if (input instanceof HTMLInputElement && input.type === "text") {
+              input.value = value;
+            } else if (
+              input instanceof HTMLInputElement &&
+              input.type === "checkbox"
+            ) {
+              input.checked = value === "true";
+            } else if (input instanceof HTMLSelectElement) {
+              input.value = value;
+            }
+          }
+        }
+      };
+
+      const loadAuth = () => {
+        return fetch(new URL("authmirror", window.location.href))
+          .then((r) => (r.status !== 200 ? null : r.json()))
+          .then((c) => {
+            creds = c;
+          });
+      };
+
+      window.addEventListener("load", () => {
+        if (
+          navigator.mediaDevices === undefined ||
+          typeof VideoEncoder === "undefined"
+        ) {
+          setMessage(
+            `can't access webcams or microphones, or WebCodecs is not available. Make sure this page is loaded over HTTPS.`,
+          );
+          return;
+        }
+
+        loadAuth()
+          .then(() => loadDevices())
+          .then(() => {
+            loadValuesFromQuery();
+            setupEventListeners();
+            video.style.display = "none";
+            controls.style.display = "flex";
+            publishButton.addEventListener("click", onPublish);
+            setMessage("");
+          })
+          .catch((err) => {
+            setMessage(err.toString());
+          });
+      });
+
+      window.addEventListener("beforeunload", () => {
+        if (publisher !== null) {
+          publisher.close();
+        }
+      });
+    </script>
+  </body>
+</html>
diff --git a/internal/servers/moq/publisher.js b/internal/servers/moq/publisher.js
new file mode 100644
index 00000000..ec9e1641
--- /dev/null
+++ b/internal/servers/moq/publisher.js
@@ -0,0 +1,822 @@
+"use strict";
+
+/**
+ * @callback OnError
+ * @param {string} err - error.
+ */
+
+/**
+ * @callback OnConnected
+ */
+
+/**
+ * @typedef Conf
+ * @type {object}
+ * @property {string} fingerprintUrl - URL to fetch the server certificate fingerprint.
+ * @property {string} url - WebTransport URL to connect to.
+ * @property {string} user - username.
+ * @property {string} pass - password.
+ * @property {string} token - token.
+ * @property {MediaStream} stream - media stream to publish.
+ * @property {string} videoCodec - video codec string (e.g., "avc3.640028").
+ * @property {number} videoBitrate - video bitrate in kbps.
+ * @property {number} videoFramerate - video framerate.
+ * @property {number} videoKeyframeInterval - video keyframe interval in seconds.
+ * @property {number} videoWidth - video width.
+ * @property {number} videoHeight - video height.
+ * @property {string} audioCodec - audio codec string (e.g., "opus").
+ * @property {number} audioBitrate - audio bitrate in kbps.
+ * @property {OnError} onError - called when there's an error.
+ * @property {OnConnected} onConnected - called when publishing has started.
+ */
+
+/** Media-over-QUIC publisher. */
+class MediaMTXMoQPublisher {
+  static #RETRY_PAUSE = 2000;
+
+  static #MOQT_VERSION = "moqt-18";
+
+  static #SETUP_TYPE = 0x2f00n;
+  static #MSG_PUBLISH = 0x1dn;
+  static #MSG_REQUEST_OK = 0x07n;
+  static #MSG_REQUEST_ERROR = 0x05n;
+  static #SUBGROUP_TYPE = 0x30n;
+  static #SUBGROUP_TYPE_WITH_PROPS = 0x31n;
+  static #PARAM_AUTH_TOKEN = 0x03n;
+  static #USE_VALUE = 3n;
+
+  static #NAMESPACE = "stream";
+
+  #conf;
+  #state = "running";
+  #restartTimeout = null;
+  #wt = null;
+  #fingerprint = null;
+  #uniStreamsQueue = [];
+  #uniStreamsListeners = [];
+  #videoEncoder = null;
+  #audioEncoder = null;
+
+  /**
+   * Create a MediaMTXMoQPublisher.
+   * @param {Conf} conf - configuration.
+   */
+  constructor(conf) {
+    this.#conf = conf;
+    this.#start();
+  }
+
+  /**
+   * Close the publisher and all its resources.
+   */
+  close() {
+    this.#state = "closed";
+    this.#cleanup();
+    if (this.#restartTimeout !== null) {
+      clearTimeout(this.#restartTimeout);
+    }
+  }
+
+  #cleanup() {
+    if (this.#wt !== null) {
+      this.#wt.close();
+      this.#wt = null;
+    }
+
+    if (this.#videoEncoder !== null) {
+      try {
+        this.#videoEncoder.close();
+      } catch (e) {}
+      this.#videoEncoder = null;
+    }
+
+    if (this.#audioEncoder !== null) {
+      try {
+        this.#audioEncoder.close();
+      } catch (e) {}
+      this.#audioEncoder = null;
+    }
+
+    this.#uniStreamsQueue = [];
+    for (const w of this.#uniStreamsListeners) {
+      w.reject(new Error("restarting"));
+    }
+    this.#uniStreamsListeners = [];
+  }
+
+  #handleError(err) {
+    if (this.#state === "running") {
+      this.#state = "restarting";
+
+      this.#cleanup();
+
+      this.#restartTimeout = window.setTimeout(
+        () => this.#restart(),
+        MediaMTXMoQPublisher.#RETRY_PAUSE,
+      );
+
+      if (this.#conf.onError !== undefined) {
+        this.#conf.onError(`${err}, retrying in some seconds`);
+      }
+    }
+  }
+
+  #restart() {
+    this.#restartTimeout = null;
+    this.#state = "running";
+    this.#start();
+  }
+
+  #start() {
+    this.#fetchFingerprint()
+      .then(() => this.#connect())
+      .then(() => this.#setup())
+      .then(() => this.#publishAllTracks())
+      .catch((err) => this.#handleError(err.message));
+  }
+
+  async #fetchFingerprint() {
+    const hex = await fetch(this.#conf.fingerprintUrl, {
+      headers: this.#authHeader(),
+    }).then((r) => r.text());
+    this.#fingerprint = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < this.#fingerprint.length; i++)
+      this.#fingerprint[i] = parseInt(hex.slice(2 * i, 2 * i + 2), 16);
+  }
+
+  #authHeader() {
+    if (this.#conf.user !== undefined && this.#conf.user !== "") {
+      const credentials = btoa(`${this.#conf.user}:${this.#conf.pass}`);
+      return { Authorization: `Basic ${credentials}` };
+    }
+    if (this.#conf.token !== undefined && this.#conf.token !== "") {
+      return { Authorization: `Bearer ${this.#conf.token}` };
+    }
+    return {};
+  }
+
+  #encodeAuthParams() {
+    let tokenValue = null;
+    if (this.#conf.user !== undefined && this.#conf.user !== "") {
+      const credentials = btoa(`${this.#conf.user}:${this.#conf.pass}`);
+      tokenValue = new TextEncoder().encode(`Basic ${credentials}`);
+    } else if (this.#conf.token !== undefined && this.#conf.token !== "") {
+      tokenValue = new TextEncoder().encode(`Bearer ${this.#conf.token}`);
+    }
+
+    if (tokenValue === null) {
+      return MediaMTXMoQPublisher.#encodeVarint(0);
+    }
+
+    const tokenStruct = MediaMTXMoQPublisher.#concat(
+      MediaMTXMoQPublisher.#encodeVarint(MediaMTXMoQPublisher.#USE_VALUE),
+      MediaMTXMoQPublisher.#encodeVarint(0), // Token Type (out-of-band)
+      tokenValue,
+    );
+
+    const param = MediaMTXMoQPublisher.#concat(
+      MediaMTXMoQPublisher.#encodeVarint(
+        MediaMTXMoQPublisher.#PARAM_AUTH_TOKEN,
+      ),
+      MediaMTXMoQPublisher.#encodeVarint(tokenStruct.length),
+      tokenStruct,
+    );
+    return MediaMTXMoQPublisher.#concat(
+      MediaMTXMoQPublisher.#encodeVarint(1),
+      param,
+    );
+  }
+
+  async #connect() {
+    this.#wt = new WebTransport(this.#conf.url, {
+      serverCertificateHashes: [
+        { algorithm: "sha-256", value: this.#fingerprint.buffer },
+      ],
+      protocols: [MediaMTXMoQPublisher.#MOQT_VERSION],
+    });
+    await this.#wt.ready;
+    console.log("connected");
+
+    this.#wt.closed
+      .then(() => this.#handleError("connection closed"))
+      .catch((err) => this.#handleError(err.message));
+
+    this.#acceptUniStreams().catch((err) => this.#handleError(err.message));
+  }
+
+  async #acceptUniStreams() {
+    const reader = this.#wt.incomingUnidirectionalStreams.getReader();
+    for (;;) {
+      const { value, done } = await reader.read();
+      if (done) {
+        break;
+      }
+      if (this.#uniStreamsListeners.length > 0) {
+        this.#uniStreamsListeners.shift().resolve(value);
+      } else {
+        this.#uniStreamsQueue.push(value);
+      }
+    }
+  }
+
+  #nextUni() {
+    return new Promise((resolve, reject) => {
+      if (this.#uniStreamsQueue.length > 0) {
+        resolve(this.#uniStreamsQueue.shift());
+      } else {
+        this.#uniStreamsListeners.push({ resolve, reject });
+      }
+    });
+  }
+
+  async #setup() {
+    const tx = await this.#wt.createUnidirectionalStream();
+    const w = tx.getWriter();
+    await w.write(
+      MediaMTXMoQPublisher.#encodeVarint(MediaMTXMoQPublisher.#SETUP_TYPE),
+    );
+    await w.write(new Uint8Array([0x00, 0x00]));
+    w.releaseLock();
+
+    const rx = new MediaMTXMoQPublisher.#StreamReader(await this.#nextUni());
+    const t = await rx.readVarint();
+    if (t !== MediaMTXMoQPublisher.#SETUP_TYPE) {
+      throw new Error("unexpected setup type 0x" + t.toString(16));
+    }
+    await rx.readBytes(await rx.readU16());
+    console.log("setup ok");
+  }
+
+  #buildCatalog() {
+    const tracks = [];
+    let trackIdx = 0;
+
+    const videoTracks = this.#conf.stream.getVideoTracks();
+    if (videoTracks.length > 0) {
+      tracks.push({
+        name: String(trackIdx),
+        packaging: "loc",
+        isLive: true,
+        codec: this.#conf.videoCodec,
+        clockrate: 90000,
+      });
+      trackIdx++;
+    }
+
+    const audioTracks = this.#conf.stream.getAudioTracks();
+    if (audioTracks.length > 0) {
+      const audioSettings = audioTracks[0].getSettings();
+      tracks.push({
+        name: String(trackIdx),
+        packaging: "loc",
+        isLive: true,
+        codec: this.#conf.audioCodec,
+        clockrate: audioSettings.sampleRate || 48000,
+        samplerate: audioSettings.sampleRate || 48000,
+        channels: audioSettings.channelCount || 1,
+      });
+    }
+
+    return { version: 1, tracks };
+  }
+
+  async #publishAllTracks() {
+    const catalog = this.#buildCatalog();
+    const catalogJSON = JSON.stringify(catalog);
+    console.log("catalog:", catalog);
+
+    await Promise.all([
+      this.#publish(0n, ".catalog", 0n),
+      this.#writeCatalog(catalogJSON, 0n),
+    ]);
+
+    await Promise.all(
+      catalog.tracks.map((track, idx) =>
+        this.#publish(BigInt((idx + 1) * 2), track.name, BigInt(idx + 1)),
+      ),
+    );
+
+    if (this.#conf.onConnected !== undefined) {
+      this.#conf.onConnected();
+    }
+
+    const promises = [];
+    let alias = 1n;
+
+    const videoTracks = this.#conf.stream.getVideoTracks();
+    if (videoTracks.length > 0) {
+      promises.push(this.#encodeVideo(videoTracks[0], alias));
+      alias++;
+    }
+
+    const audioTracks = this.#conf.stream.getAudioTracks();
+    if (audioTracks.length > 0) {
+      promises.push(this.#encodeAudio(audioTracks[0], alias));
+      alias++;
+    }
+
+    await Promise.all(promises);
+  }
+
+  async #publish(requestId, trackName, trackAlias) {
+    const bidi = await this.#wt.createBidirectionalStream();
+    const w = bidi.writable.getWriter();
+    const r = new MediaMTXMoQPublisher.#StreamReader(bidi.readable);
+
+    await w.write(
+      MediaMTXMoQPublisher.#encodeMsg(
+        MediaMTXMoQPublisher.#MSG_PUBLISH,
+        MediaMTXMoQPublisher.#concat(
+          MediaMTXMoQPublisher.#encodeVarint(requestId),
+          MediaMTXMoQPublisher.#encodeNamespace(
+            MediaMTXMoQPublisher.#NAMESPACE,
+          ),
+          MediaMTXMoQPublisher.#encodeString(trackName),
+          MediaMTXMoQPublisher.#encodeVarint(trackAlias),
+          this.#encodeAuthParams(),
+        ),
+      ),
+    );
+    w.releaseLock();
+
+    const t = await r.readVarint();
+    const payload = await r.readBytes(await r.readU16());
+    switch (t) {
+      case MediaMTXMoQPublisher.#MSG_REQUEST_ERROR:
+        throw new Error(MediaMTXMoQPublisher.#requestErrorReason(payload));
+      case MediaMTXMoQPublisher.#MSG_REQUEST_OK:
+        break;
+      default:
+        throw new Error("expected REQUEST_OK (0x7), got 0x" + t.toString(16));
+    }
+    console.log("REQUEST_OK for track", trackName);
+  }
+
+  async #encodeVideo(mediaTrack, trackAlias) {
+    const isAvc = this.#conf.videoCodec.startsWith("avc3");
+    const isHvc = this.#conf.videoCodec.startsWith("hev1");
+    const processor = new MediaStreamTrackProcessor({ track: mediaTrack });
+    const frameReader = processor.readable.getReader();
+
+    let groupId = 0n;
+    let vps = null;
+    let sps = null;
+    let pps = null;
+
+    this.#videoEncoder = new VideoEncoder({
+      output: (chunk, metadata) => {
+        if (isAvc && metadata?.decoderConfig?.description !== undefined) {
+          [sps, pps] = MediaMTXMoQPublisher.#parseAvcC(
+            metadata.decoderConfig.description,
+          );
+        } else if (
+          isHvc &&
+          metadata?.decoderConfig?.description !== undefined
+        ) {
+          [vps, sps, pps] = MediaMTXMoQPublisher.#parseHvcC(
+            metadata.decoderConfig.description,
+          );
+        }
+
+        let data = new Uint8Array(chunk.byteLength);
+        chunk.copyTo(data);
+
+        if (isAvc && chunk.type === "key" && sps !== null && pps !== null) {
+          data = MediaMTXMoQPublisher.#concat(
+            MediaMTXMoQPublisher.#avccLen(sps.length),
+            sps,
+            MediaMTXMoQPublisher.#avccLen(pps.length),
+            pps,
+            data,
+          );
+        } else if (
+          isHvc &&
+          chunk.type === "key" &&
+          vps !== null &&
+          sps !== null &&
+          pps !== null
+        ) {
+          data = MediaMTXMoQPublisher.#concat(
+            MediaMTXMoQPublisher.#avccLen(vps.length),
+            vps,
+            MediaMTXMoQPublisher.#avccLen(sps.length),
+            sps,
+            MediaMTXMoQPublisher.#avccLen(pps.length),
+            pps,
+            data,
+          );
+        }
+
+        this.#writeData(
+          trackAlias,
+          groupId++,
+          chunk.timestamp,
+          90000,
+          data,
+        ).catch((err) => this.#handleError(err.message));
+      },
+      error: (err) => console.error(err.message),
+    });
+
+    const videoConfig = {
+      codec: this.#conf.videoCodec,
+      bitrate: this.#conf.videoBitrate * 1000,
+      framerate: this.#conf.videoFramerate,
+      width: this.#conf.videoWidth,
+      height: this.#conf.videoHeight,
+      latencyMode: "realtime",
+    };
+    this.#videoEncoder.configure(videoConfig);
+
+    let frameCount = 0n;
+
+    for (;;) {
+      const { value: frame, done } = await frameReader.read();
+      if (done) break;
+      if (this.#state !== "running") {
+        frame.close();
+        break;
+      }
+      this.#videoEncoder.encode(frame, {
+        keyFrame: frameCount % BigInt(this.#conf.videoKeyframeInterval) === 0n,
+      });
+      frame.close();
+      frameCount++;
+    }
+  }
+
+  async #encodeAudio(mediaTrack, trackAlias) {
+    const processor = new MediaStreamTrackProcessor({ track: mediaTrack });
+    const frameReader = processor.readable.getReader();
+    const audioSettings = mediaTrack.getSettings();
+    const sampleRate = audioSettings.sampleRate || 48000;
+    const channelCount = audioSettings.channelCount || 1;
+
+    let groupId = 0n;
+
+    this.#audioEncoder = new AudioEncoder({
+      output: (chunk) => {
+        const data = new Uint8Array(chunk.byteLength);
+        chunk.copyTo(data);
+        this.#writeData(
+          trackAlias,
+          groupId++,
+          chunk.timestamp,
+          sampleRate,
+          data,
+        ).catch((err) => this.#handleError(err.message));
+      },
+      error: (err) => console.error(err.message),
+    });
+
+    this.#audioEncoder.configure({
+      codec: this.#conf.audioCodec,
+      sampleRate: sampleRate,
+      numberOfChannels: channelCount,
+      bitrate: (this.#conf.audioBitrate || 128) * 1000,
+    });
+
+    for (;;) {
+      const { value: frame, done } = await frameReader.read();
+      if (done) break;
+      if (this.#state !== "running" || this.#audioEncoder === null) {
+        frame.close();
+        break;
+      }
+      this.#audioEncoder.encode(frame);
+      frame.close();
+    }
+  }
+
+  async #writeCatalog(catalogJSON, trackAlias) {
+    const payload = new TextEncoder().encode(catalogJSON);
+    const uniStream = await this.#wt.createUnidirectionalStream();
+    const w = uniStream.getWriter();
+    await w.write(
+      MediaMTXMoQPublisher.#concat(
+        MediaMTXMoQPublisher.#encodeVarint(MediaMTXMoQPublisher.#SUBGROUP_TYPE),
+        MediaMTXMoQPublisher.#encodeVarint(trackAlias),
+        MediaMTXMoQPublisher.#encodeVarint(0),
+        MediaMTXMoQPublisher.#encodeVarint(0),
+        MediaMTXMoQPublisher.#encodeVarint(payload.length),
+        payload,
+        new Uint8Array([0x00, 0x00, 0x03]),
+      ),
+    );
+    await w.close();
+    console.log("catalog sent");
+  }
+
+  async #writeData(trackAlias, groupId, timestamp, clockrate, payload) {
+    const tsType = MediaMTXMoQPublisher.#encodeVarint(0x06n);
+    const tsValue = MediaMTXMoQPublisher.#encodeVarint(
+      BigInt(Math.round((timestamp * clockrate) / 1000000)),
+    );
+    const kv = MediaMTXMoQPublisher.#concat(tsType, tsValue);
+    const propsBlock = MediaMTXMoQPublisher.#concat(
+      MediaMTXMoQPublisher.#encodeVarint(kv.length),
+      kv,
+    );
+
+    const uniStream = await this.#wt.createUnidirectionalStream();
+    const w = uniStream.getWriter();
+    await w.write(
+      MediaMTXMoQPublisher.#concat(
+        MediaMTXMoQPublisher.#encodeVarint(
+          MediaMTXMoQPublisher.#SUBGROUP_TYPE_WITH_PROPS,
+        ),
+        MediaMTXMoQPublisher.#encodeVarint(trackAlias),
+        MediaMTXMoQPublisher.#encodeVarint(groupId),
+        MediaMTXMoQPublisher.#encodeVarint(0),
+        propsBlock,
+        MediaMTXMoQPublisher.#encodeVarint(payload.length),
+        payload,
+        new Uint8Array([0x00, 0x00, 0x00, 0x03]),
+      ),
+    );
+    await w.close();
+  }
+
+  static #readVarintFromBytes(bytes, offset) {
+    const b = bytes[offset];
+    if ((b & 0x80) === 0) return { value: BigInt(b), size: 1 };
+    if ((b & 0xc0) === 0x80)
+      return { value: BigInt(((b & 0x3f) << 8) | bytes[offset + 1]), size: 2 };
+    if ((b & 0xe0) === 0xc0)
+      return {
+        value: BigInt(
+          ((b & 0x1f) << 16) | (bytes[offset + 1] << 8) | bytes[offset + 2],
+        ),
+        size: 3,
+      };
+    if ((b & 0xf0) === 0xe0)
+      return {
+        value: BigInt(
+          ((b & 0x0f) << 24) |
+            (bytes[offset + 1] << 16) |
+            (bytes[offset + 2] << 8) |
+            bytes[offset + 3],
+        ),
+        size: 4,
+      };
+    throw new Error("varint too long");
+  }
+
+  static #requestErrorReason(payload) {
+    let off = 0;
+    let v = MediaMTXMoQPublisher.#readVarintFromBytes(payload, off);
+    off += v.size; // skip error code
+    v = MediaMTXMoQPublisher.#readVarintFromBytes(payload, off);
+    off += v.size; // skip retry interval
+    v = MediaMTXMoQPublisher.#readVarintFromBytes(payload, off);
+    off += v.size; // reason length
+    return new TextDecoder().decode(payload.slice(off, off + Number(v.value)));
+  }
+
+  static #avccLen(l) {
+    return new Uint8Array([
+      (l >> 24) & 0xff,
+      (l >> 16) & 0xff,
+      (l >> 8) & 0xff,
+      l & 0xff,
+    ]);
+  }
+
+  static #parseAvcC(description) {
+    let sps = null;
+    let pps = null;
+    const desc = new Uint8Array(description);
+    let off = 5;
+    const numSPS = desc[off++] & 0x1f;
+    for (let i = 0; i < numSPS; i++) {
+      const len = (desc[off] << 8) | desc[off + 1];
+      off += 2;
+      sps = desc.slice(off, off + len);
+      off += len;
+    }
+    const numPPS = desc[off++];
+    for (let i = 0; i < numPPS; i++) {
+      const len = (desc[off] << 8) | desc[off + 1];
+      off += 2;
+      pps = desc.slice(off, off + len);
+      off += len;
+    }
+    return [sps, pps];
+  }
+
+  static #parseHvcC(description) {
+    let vps = null;
+    let sps = null;
+    let pps = null;
+    const desc = new Uint8Array(description);
+    let off = 22; // skip 22-byte fixed header
+    const numArrays = desc[off++];
+    for (let i = 0; i < numArrays; i++) {
+      const naluType = desc[off++] & 0x3f;
+      const numNalus = (desc[off] << 8) | desc[off + 1];
+      off += 2;
+      for (let j = 0; j < numNalus; j++) {
+        const len = (desc[off] << 8) | desc[off + 1];
+        off += 2;
+        const nalu = desc.slice(off, off + len);
+        off += len;
+        if (naluType === 32) vps = nalu;
+        else if (naluType === 33) sps = nalu;
+        else if (naluType === 34) pps = nalu;
+      }
+    }
+    return [vps, sps, pps];
+  }
+
+  static #encodeVarint(value) {
+    const v = BigInt(value);
+    if (v < 128n) {
+      return new Uint8Array([Number(v)]);
+    }
+    if (v < 16384n) {
+      return new Uint8Array([0x80 | Number(v >> 8n), Number(v & 0xffn)]);
+    }
+    if (v < 2097152n) {
+      return new Uint8Array([
+        0xc0 | Number(v >> 16n),
+        Number((v >> 8n) & 0xffn),
+        Number(v & 0xffn),
+      ]);
+    }
+    if (v < 268435456n) {
+      return new Uint8Array([
+        0xe0 | Number(v >> 24n),
+        Number((v >> 16n) & 0xffn),
+        Number((v >> 8n) & 0xffn),
+        Number(v & 0xffn),
+      ]);
+    }
+    if (v < 34359738368n) {
+      return new Uint8Array([
+        0xf0 | Number(v >> 32n),
+        Number((v >> 24n) & 0xffn),
+        Number((v >> 16n) & 0xffn),
+        Number((v >> 8n) & 0xffn),
+        Number(v & 0xffn),
+      ]);
+    }
+    if (v < 4398046511104n) {
+      return new Uint8Array([
+        0xf8 | Number(v >> 40n),
+        Number((v >> 32n) & 0xffn),
+        Number((v >> 24n) & 0xffn),
+        Number((v >> 16n) & 0xffn),
+        Number((v >> 8n) & 0xffn),
+        Number(v & 0xffn),
+      ]);
+    }
+    if (v < 562949953421312n) {
+      return new Uint8Array([
+        0xfc | Number(v >> 48n),
+        Number((v >> 40n) & 0xffn),
+        Number((v >> 32n) & 0xffn),
+        Number((v >> 24n) & 0xffn),
+        Number((v >> 16n) & 0xffn),
+        Number((v >> 8n) & 0xffn),
+        Number(v & 0xffn),
+      ]);
+    }
+    if (v < 72057594037927936n) {
+      return new Uint8Array([
+        0xfe,
+        Number((v >> 48n) & 0xffn),
+        Number((v >> 40n) & 0xffn),
+        Number((v >> 32n) & 0xffn),
+        Number((v >> 24n) & 0xffn),
+        Number((v >> 16n) & 0xffn),
+        Number((v >> 8n) & 0xffn),
+        Number(v & 0xffn),
+      ]);
+    }
+    return new Uint8Array([
+      0xff,
+      Number((v >> 56n) & 0xffn),
+      Number((v >> 48n) & 0xffn),
+      Number((v >> 40n) & 0xffn),
+      Number((v >> 32n) & 0xffn),
+      Number((v >> 24n) & 0xffn),
+      Number((v >> 16n) & 0xffn),
+      Number((v >> 8n) & 0xffn),
+      Number(v & 0xffn),
+    ]);
+  }
+
+  static #concat(...arrays) {
+    const total = arrays.reduce((n, a) => n + a.length, 0);
+    const out = new Uint8Array(total);
+    let pos = 0;
+    for (const a of arrays) {
+      out.set(a, pos);
+      pos += a.length;
+    }
+    return out;
+  }
+
+  static #encodeString(s) {
+    const b = new TextEncoder().encode(s);
+    return MediaMTXMoQPublisher.#concat(
+      MediaMTXMoQPublisher.#encodeVarint(b.length),
+      b,
+    );
+  }
+
+  static #encodeNamespace(parts) {
+    let b = MediaMTXMoQPublisher.#encodeVarint(parts.length);
+    for (const p of parts)
+      b = MediaMTXMoQPublisher.#concat(
+        b,
+        MediaMTXMoQPublisher.#encodeString(p),
+      );
+    return b;
+  }
+
+  static #encodeMsg(type, payload) {
+    return MediaMTXMoQPublisher.#concat(
+      MediaMTXMoQPublisher.#encodeVarint(type),
+      new Uint8Array([(payload.length >> 8) & 0xff, payload.length & 0xff]),
+      payload,
+    );
+  }
+
+  static #StreamReader = class {
+    #reader = null;
+    #buf = new Uint8Array(0);
+
+    constructor(src) {
+      this.#reader = src.getReader();
+    }
+
+    async #fill() {
+      if (!this.#reader) {
+        throw new Error("stream ended");
+      }
+      const { value, done } = await this.#reader.read();
+      if (done) {
+        throw new Error("stream ended");
+      }
+      const next = new Uint8Array(this.#buf.length + value.length);
+      next.set(this.#buf);
+      next.set(value, this.#buf.length);
+      this.#buf = next;
+    }
+
+    async readBytes(n) {
+      while (this.#buf.length < n) await this.#fill();
+      const out = this.#buf.slice(0, n);
+      this.#buf = this.#buf.slice(n);
+      return out;
+    }
+
+    async readVarint() {
+      while (this.#buf.length < 1) await this.#fill();
+      const b = this.#buf[0];
+      let size;
+      if ((b & 0x80) === 0) {
+        size = 1;
+      } else if ((b & 0xc0) === 0x80) {
+        size = 2;
+      } else if ((b & 0xe0) === 0xc0) {
+        size = 3;
+      } else if ((b & 0xf0) === 0xe0) {
+        size = 4;
+      } else if ((b & 0xf8) === 0xf0) {
+        size = 5;
+      } else {
+        throw new Error("unsupported varint: 0x" + b.toString(16));
+      }
+      const d = await this.readBytes(size);
+      switch (size) {
+        case 1:
+          return BigInt(d[0]);
+        case 2:
+          return BigInt(((d[0] & 0x3f) << 8) | d[1]);
+        case 3:
+          return BigInt(((d[0] & 0x1f) << 16) | (d[1] << 8) | d[2]);
+        case 4:
+          return BigInt(
+            ((d[0] & 0x0f) << 24) | (d[1] << 16) | (d[2] << 8) | d[3],
+          );
+        case 5:
+          return (
+            (BigInt(d[0] & 0x07) << 32n) |
+            (BigInt(d[1]) << 24n) |
+            (BigInt(d[2]) << 16n) |
+            (BigInt(d[3]) << 8n) |
+            BigInt(d[4])
+          );
+      }
+    }
+
+    async readU16() {
+      const d = await this.readBytes(2);
+      return (d[0] << 8) | d[1];
+    }
+  };
+}
+
+window.MediaMTXMoQPublisher = MediaMTXMoQPublisher;
diff --git a/internal/servers/moq/read_index.html b/internal/servers/moq/read_index.html
new file mode 100644
index 00000000..695f182f
--- /dev/null
+++ b/internal/servers/moq/read_index.html
@@ -0,0 +1,111 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width" />
+    <style>
+      html,
+      body {
+        margin: 0;
+        padding: 0;
+        height: 100%;
+        font-family: "Arial", sans-serif;
+      }
+      #video {
+        width: 100%;
+        height: 100%;
+        background: rgb(30, 30, 30);
+        position: relative;
+      }
+      #video canvas {
+        position: absolute;
+        top: 0;
+        left: 0;
+        width: 100%;
+        height: 100%;
+        object-fit: contain;
+      }
+      #mute {
+        position: absolute;
+        bottom: 40px;
+        right: 40px;
+        width: 60px;
+        height: 60px;
+        background-image: url("data:image/svg+xml,%3C%3Fxml version='1.0' encoding='UTF-8'%3F%3E%3Csvg id='Layer_1' data-name='Layer 1' xmlns='http://www.w3.org/2000/svg' viewBox='0 0 300 300'%3E%3Cdefs%3E%3Cstyle%3E .cls-1 %7B fill: %23fff; %7D .cls-2 %7B fill: %23cdcfd0; %7D %3C/style%3E%3C/defs%3E%3Cline class='cls-1' x1='20.08' y1='20.08' x2='279.92' y2='279.92'/%3E%3Cg%3E%3Cpath class='cls-2' d='M199.86,150.24c0,7.59-1.21,15.03-3.5,22.07l8.33,8.33c3.81-9.55,5.85-19.84,5.85-30.4,0-27.34-13.54-52.81-36.23-68.14l-5.97,8.84c19.74,13.34,31.53,35.51,31.53,59.3Z'/%3E%3Cpath class='cls-2' d='M177.82,201.87c-2.73,2.62-5.67,5.04-8.84,7.22l6.07,8.77c3.69-2.55,7.13-5.39,10.31-8.45l-7.54-7.54Z'/%3E%3C/g%3E%3Crect class='cls-2' x='141.5' y='-33.74' width='17' height='367.48' transform='translate(-62.13 150) rotate(-45)'/%3E%3Cg%3E%3Cpath class='cls-2' d='M231.75,150.24c0,16.38-4.22,31.98-11.88,45.59l7.81,7.81c9.49-15.77,14.75-34.1,14.75-53.39,0-39.5-21.98-74.98-57.35-92.6l-4.76,9.55c31.73,15.81,51.44,47.63,51.44,83.05Z'/%3E%3Cpath class='cls-2' d='M197.89,221.93c-5.34,4.36-11.21,8.19-17.58,11.36l4.76,9.55c7.42-3.7,14.24-8.19,20.4-13.33l-7.58-7.58Z'/%3E%3C/g%3E%3Cg%3E%3Cpath class='cls-2' d='M260.74,150c0,24.2-7.65,46.96-21.11,65.59l7.56,7.56c.91-1.22,1.8-2.46,2.67-3.72,14.1-20.47,21.55-44.48,21.55-69.43s-7.45-48.96-21.55-69.43c-13.77-19.99-32.91-35.32-55.35-44.34l-3.98,9.9c42.65,17.13,70.2,57.9,70.2,103.86Z'/%3E%3Cpath class='cls-2' d='M215.73,239.78c-7.63,5.66-16.06,10.42-25.2,14.09l3.98,9.9c10.38-4.17,20.04-9.7,28.8-16.41l-7.58-7.58Z'/%3E%3C/g%3E%3Cg%3E%3Cpolygon class='cls-2' points='146.6 124.61 146.6 54.28 111.14 89.14 146.6 124.61'/%3E%3Cpolygon class='cls-2' points='80.49 106.57 28.59 106.57 28.59 201.95 85.17 201.95 146.6 254.25 146.6 172.69 80.49 106.57'/%3E%3C/g%3E%3C/svg%3E");
+        background-size: 80%;
+        background-position: center;
+        background-repeat: no-repeat;
+        cursor: pointer;
+        display: none;
+      }
+      #message {
+        position: absolute;
+        left: 0;
+        top: 0;
+        width: 100%;
+        height: 100%;
+        display: flex;
+        align-items: center;
+        text-align: center;
+        justify-content: center;
+        font-size: 16px;
+        font-weight: bold;
+        color: white;
+        pointer-events: none;
+        padding: 20px;
+        box-sizing: border-box;
+        text-shadow: 0 0 5px black;
+      }
+    </style>
+    <script defer src="./reader.js"></script>
+  </head>
+  <body>
+    <div id="video"></div>
+    <div id="mute"></div>
+    <div id="message"></div>
+
+    <script>
+      const message = document.getElementById("message");
+      const mute = document.getElementById("mute");
+
+      let reader = null;
+
+      const setMessage = (str) => {
+        message.innerText = str;
+      };
+
+      window.addEventListener("load", () => {
+        fetch(new URL("authmirror", window.location.href))
+          .then((r) => (r.status !== 200 ? null : r.json()))
+          .then((creds) => {
+            reader = new MediaMTXMoQReader({
+              fingerprintUrl: new URL("fingerprint", window.location.href),
+              url:
+                new URL("moq", window.location.href) + window.location.search,
+              user: creds?.user,
+              pass: creds?.pass,
+              videoElement: document.getElementById("video"),
+              onError: (err) => {
+                setMessage(err);
+              },
+              onSubscribed: (hasAudio) => {
+                setMessage("");
+              },
+              onAudioMuted: (muted) => {
+                mute.style.display = muted ? "block" : "none";
+              },
+            });
+          })
+          .catch((err) => {
+            setMessage("Failed to fetch credentials: " + err);
+          });
+      });
+
+      mute.addEventListener("click", () => {
+        if (reader !== null) {
+          reader.unmute();
+        }
+      });
+    </script>
+  </body>
+</html>
diff --git a/internal/servers/moq/reader.js b/internal/servers/moq/reader.js
new file mode 100644
index 00000000..ed5f7b9d
--- /dev/null
+++ b/internal/servers/moq/reader.js
@@ -0,0 +1,1263 @@
+"use strict";
+
+/**
+ * @callback OnError
+ * @param {string} err - error.
+ */
+
+/**
+ * @callback OnSubscribed
+ * @param {boolean} hasAudio - whether an audio track was subscribed.
+ */
+
+/**
+ * @callback OnAudioMuted
+ * @param {boolean} muted - whether the audio is muted.
+ */
+
+/**
+ * @typedef Conf
+ * @type {object}
+ * @property {string} fingerprintUrl - URL to fetch the server certificate fingerprint.
+ * @property {string} url - WebTransport URL to connect to.
+ * @property {string} user - username.
+ * @property {string} pass - password.
+ * @property {string} token - token.
+ * @property {HTMLElement} videoElement - element where the video canvas will be appended.
+ * @property {OnError} onError - called when there's an error.
+ * @property {OnSubscribed} onSubscribed - called when track subscription is successful.
+ * @property {OnAudioMuted} onAudioMuted - called when audio is muted or unmuted.
+ */
+
+/** Media-over-QUIC reader. */
+class MediaMTXMoQReader {
+  static #RETRY_PAUSE = 2000;
+
+  static #MOQT_VERSION = "moqt-18";
+
+  static #SETUP_TYPE = 0x2f00n;
+  static #MSG_SUBSCRIBE = 0x03n;
+  static #MSG_SUBSCRIBE_OK = 0x04n;
+  static #MSG_REQUEST_ERROR = 0x05n;
+  static #SUBGROUP_TYPE_MASK = 0x90n;
+  static #SUBGROUP_TYPE_BITS = 0x10n;
+  static #SUBGROUP_PROPS_BIT = 0x01n;
+  static #PARAM_AUTH_TOKEN = 0x03n;
+  static #USE_VALUE = 3n;
+
+  static #NAMESPACE = "stream";
+  static #VIDEO_REQUEST_ID = BigInt(10);
+  static #AUDIO_REQUEST_ID = BigInt(11);
+
+  static #MAX_VIDEO_REORDERED_SUBGROUPS = 30;
+  static #MAX_VIDEO_FRAMES_IN_DECODER = 10;
+
+  static #MAX_AUDIO_REORDERED_SUBGROUPS = 50;
+  static #MAX_AUDIO_FRAMES_IN_DECODER = 10;
+  static #AUDIO_START_LATENCY_SECS = 0.0;
+  static #AUDIO_MAX_LATENCY_SECS = 0.5;
+
+  #conf;
+  #state = "running";
+  #restartTimeout = null;
+  #wt = null;
+  #fingerprint = null;
+  #catalog = null;
+  #uniStreamsQueue = [];
+  #uniStreamsListeners = [];
+  #videoTrack = null;
+  #videoParams = null;
+  #videoCanvas = null;
+  #videoDecoder = null;
+  #videoReorderer = null;
+  #audioTrack = null;
+  #audioCtx = null;
+  #audioDecoder = null;
+  #audioReorderer = null;
+
+  /**
+   * Create a MediaMTXMoQReader.
+   * @param {Conf} conf - configuration.
+   */
+  constructor(conf) {
+    this.#conf = conf;
+    this.#start();
+  }
+
+  /**
+   * Unmute the reader.
+   */
+  unmute() {
+    if (this.#audioCtx !== null) {
+      this.#audioCtx.resume().then(() => {
+        if (this.#conf.onAudioMuted !== undefined) {
+          this.#conf.onAudioMuted(false);
+        }
+      });
+    }
+  }
+
+  #start() {
+    this.#fetchFingerprint()
+      .then(() => this.#connect())
+      .then(() => this.#setup())
+      .then(() => this.#subscribeCatalog())
+      .then(() => this.#subscribeAllTracks())
+      .then(() => this.#drainDataStreams())
+      .catch((err) => this.#handleError(err.message));
+  }
+
+  /** @param {string} err */
+  #handleError(err) {
+    if (this.#state === "running") {
+      this.#state = "restarting";
+
+      if (this.#wt !== null) {
+        this.#wt.close();
+        this.#wt = null;
+      }
+
+      if (this.#videoDecoder !== null) {
+        try {
+          this.#videoDecoder.close();
+        } catch (e) {}
+        this.#videoDecoder = null;
+      }
+
+      if (this.#videoCanvas !== null) {
+        this.#videoCanvas.remove();
+        this.#videoCanvas = null;
+      }
+
+      if (this.#audioDecoder !== null) {
+        try {
+          this.#audioDecoder.close();
+        } catch (e) {}
+        this.#audioDecoder = null;
+      }
+
+      if (this.#audioCtx !== null) {
+        this.#audioCtx.close();
+        this.#audioCtx = null;
+      }
+
+      this.#uniStreamsQueue = [];
+      for (const w of this.#uniStreamsListeners) {
+        w.reject(new Error("restarting"));
+      }
+      this.#uniStreamsListeners = [];
+      this.#videoTrack = null;
+      this.#videoParams = null;
+      this.#videoReorderer = null;
+      this.#audioTrack = null;
+      this.#audioReorderer = null;
+
+      this.#restartTimeout = window.setTimeout(
+        () => this.#restart(),
+        MediaMTXMoQReader.#RETRY_PAUSE,
+      );
+
+      if (this.#conf.onAudioMuted !== undefined) {
+        this.#conf.onAudioMuted(false);
+      }
+
+      if (this.#conf.onError !== undefined) {
+        this.#conf.onError(`${err}, retrying in some seconds`);
+      }
+    }
+  }
+
+  #restart() {
+    this.#restartTimeout = null;
+    this.#state = "running";
+    this.#start();
+  }
+
+  async #fetchFingerprint() {
+    const hex = await fetch(this.#conf.fingerprintUrl, {
+      headers: this.#authHeader(),
+    }).then((r) => r.text());
+    this.#fingerprint = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < this.#fingerprint.length; i++)
+      this.#fingerprint[i] = parseInt(hex.slice(2 * i, 2 * i + 2), 16);
+  }
+
+  #authHeader() {
+    if (this.#conf.user !== undefined && this.#conf.user !== "") {
+      const credentials = btoa(`${this.#conf.user}:${this.#conf.pass}`);
+      return { Authorization: `Basic ${credentials}` };
+    }
+    if (this.#conf.token !== undefined && this.#conf.token !== "") {
+      return { Authorization: `Bearer ${this.#conf.token}` };
+    }
+    return {};
+  }
+
+  #encodeAuthParams() {
+    let tokenValue = null;
+    if (this.#conf.user !== undefined && this.#conf.user !== "") {
+      const credentials = btoa(`${this.#conf.user}:${this.#conf.pass}`);
+      tokenValue = new TextEncoder().encode(`Basic ${credentials}`);
+    } else if (this.#conf.token !== undefined && this.#conf.token !== "") {
+      tokenValue = new TextEncoder().encode(`Bearer ${this.#conf.token}`);
+    }
+
+    if (tokenValue === null) {
+      return MediaMTXMoQReader.#encodeVarint(0);
+    }
+
+    const tokenStruct = MediaMTXMoQReader.#concat(
+      MediaMTXMoQReader.#encodeVarint(MediaMTXMoQReader.#USE_VALUE),
+      MediaMTXMoQReader.#encodeVarint(0), // Token Type (out-of-band)
+      tokenValue,
+    );
+
+    const param = MediaMTXMoQReader.#concat(
+      MediaMTXMoQReader.#encodeVarint(MediaMTXMoQReader.#PARAM_AUTH_TOKEN),
+      MediaMTXMoQReader.#encodeVarint(tokenStruct.length),
+      tokenStruct,
+    );
+    return MediaMTXMoQReader.#concat(MediaMTXMoQReader.#encodeVarint(1), param);
+  }
+
+  async #connect() {
+    this.#wt = new WebTransport(this.#conf.url, {
+      serverCertificateHashes: [
+        { algorithm: "sha-256", value: this.#fingerprint.buffer },
+      ],
+      protocols: [MediaMTXMoQReader.#MOQT_VERSION],
+    });
+    await this.#wt.ready;
+    console.log("connected");
+
+    this.#wt.closed
+      .then(() => this.#handleError("connection closed"))
+      .catch((err) => this.#handleError(err.message));
+
+    this.#acceptUniStreams().catch((err) => this.#handleError(err.message));
+  }
+
+  async #acceptUniStreams() {
+    const reader = this.#wt.incomingUnidirectionalStreams.getReader();
+    for (;;) {
+      const { value, done } = await reader.read();
+      if (done) {
+        break;
+      }
+      if (this.#uniStreamsListeners.length > 0) {
+        this.#uniStreamsListeners.shift().resolve(value);
+      } else {
+        this.#uniStreamsQueue.push(value);
+      }
+    }
+  }
+
+  #nextUni() {
+    return new Promise((resolve, reject) => {
+      if (this.#uniStreamsQueue.length > 0) {
+        resolve(this.#uniStreamsQueue.shift());
+      } else {
+        this.#uniStreamsListeners.push({ resolve, reject });
+      }
+    });
+  }
+
+  async #setup() {
+    const tx = await this.#wt.createUnidirectionalStream();
+    const w = tx.getWriter();
+    await w.write(
+      MediaMTXMoQReader.#encodeVarint(MediaMTXMoQReader.#SETUP_TYPE),
+    );
+    await w.write(new Uint8Array([0x00, 0x00]));
+    w.releaseLock();
+
+    const rx = new MediaMTXMoQReader.#StreamReader(await this.#nextUni());
+    const t = await rx.readVarint();
+    if (t !== MediaMTXMoQReader.#SETUP_TYPE) {
+      throw new Error("unexpected setup type 0x" + t.toString(16));
+    }
+    await rx.readBytes(await rx.readU16());
+    console.log("setup ok");
+  }
+
+  async #subscribeCatalog() {
+    const bidi = await this.#wt.createBidirectionalStream();
+    const w = bidi.writable.getWriter();
+    const r = new MediaMTXMoQReader.#StreamReader(bidi.readable);
+
+    await w.write(
+      MediaMTXMoQReader.#encodeMsg(
+        MediaMTXMoQReader.#MSG_SUBSCRIBE,
+        MediaMTXMoQReader.#concat(
+          MediaMTXMoQReader.#encodeVarint(0),
+          MediaMTXMoQReader.#encodeNamespace(MediaMTXMoQReader.#NAMESPACE),
+          MediaMTXMoQReader.#encodeString(".catalog"),
+          this.#encodeAuthParams(),
+        ),
+      ),
+    );
+    w.releaseLock();
+
+    const t = await r.readVarint();
+    switch (t) {
+      case MediaMTXMoQReader.#MSG_REQUEST_ERROR: {
+        const errPayload = await r.readBytes(await r.readU16());
+        throw new Error(MediaMTXMoQReader.#requestErrorReason(errPayload));
+      }
+      case MediaMTXMoQReader.#MSG_SUBSCRIBE_OK:
+        break;
+      default:
+        throw new Error("expected SUBSCRIBE_OK, got 0x" + t.toString(16));
+    }
+    await r.readBytes(await r.readU16());
+
+    const { data } = await this.#readSubGroup(await this.#nextUni());
+    this.#catalog = JSON.parse(new TextDecoder().decode(data));
+
+    console.log("catalog:", this.#catalog);
+  }
+
+  static #readVarintFromBytes(bytes, offset) {
+    const b = bytes[offset];
+    if ((b & 0x80) === 0) return { value: BigInt(b), size: 1 };
+    if ((b & 0xc0) === 0x80)
+      return { value: BigInt(((b & 0x3f) << 8) | bytes[offset + 1]), size: 2 };
+    if ((b & 0xe0) === 0xc0)
+      return {
+        value: BigInt(
+          ((b & 0x1f) << 16) | (bytes[offset + 1] << 8) | bytes[offset + 2],
+        ),
+        size: 3,
+      };
+    if ((b & 0xf0) === 0xe0)
+      return {
+        value: BigInt(
+          ((b & 0x0f) << 24) |
+            (bytes[offset + 1] << 16) |
+            (bytes[offset + 2] << 8) |
+            bytes[offset + 3],
+        ),
+        size: 4,
+      };
+    if ((b & 0xf8) === 0xf0)
+      return {
+        value:
+          (BigInt(b & 0x07) << 32n) |
+          (BigInt(bytes[offset + 1]) << 24n) |
+          (BigInt(bytes[offset + 2]) << 16n) |
+          (BigInt(bytes[offset + 3]) << 8n) |
+          BigInt(bytes[offset + 4]),
+        size: 5,
+      };
+    if ((b & 0xfc) === 0xf8)
+      return {
+        value:
+          (BigInt(b & 0x03) << 40n) |
+          (BigInt(bytes[offset + 1]) << 32n) |
+          (BigInt(bytes[offset + 2]) << 24n) |
+          (BigInt(bytes[offset + 3]) << 16n) |
+          (BigInt(bytes[offset + 4]) << 8n) |
+          BigInt(bytes[offset + 5]),
+        size: 6,
+      };
+    if ((b & 0xfe) === 0xfc)
+      return {
+        value:
+          (BigInt(b & 0x01) << 48n) |
+          (BigInt(bytes[offset + 1]) << 40n) |
+          (BigInt(bytes[offset + 2]) << 32n) |
+          (BigInt(bytes[offset + 3]) << 24n) |
+          (BigInt(bytes[offset + 4]) << 16n) |
+          (BigInt(bytes[offset + 5]) << 8n) |
+          BigInt(bytes[offset + 6]),
+        size: 7,
+      };
+    if (b === 0xfe)
+      return {
+        value:
+          (BigInt(bytes[offset + 1]) << 48n) |
+          (BigInt(bytes[offset + 2]) << 40n) |
+          (BigInt(bytes[offset + 3]) << 32n) |
+          (BigInt(bytes[offset + 4]) << 24n) |
+          (BigInt(bytes[offset + 5]) << 16n) |
+          (BigInt(bytes[offset + 6]) << 8n) |
+          BigInt(bytes[offset + 7]),
+        size: 8,
+      };
+    return {
+      value:
+        (BigInt(bytes[offset + 1]) << 56n) |
+        (BigInt(bytes[offset + 2]) << 48n) |
+        (BigInt(bytes[offset + 3]) << 40n) |
+        (BigInt(bytes[offset + 4]) << 32n) |
+        (BigInt(bytes[offset + 5]) << 24n) |
+        (BigInt(bytes[offset + 6]) << 16n) |
+        (BigInt(bytes[offset + 7]) << 8n) |
+        BigInt(bytes[offset + 8]),
+      size: 9,
+    };
+  }
+
+  static #requestErrorReason(payload) {
+    let off = 0;
+    let v = MediaMTXMoQReader.#readVarintFromBytes(payload, off);
+    off += v.size;
+    v = MediaMTXMoQReader.#readVarintFromBytes(payload, off);
+    off += v.size;
+    v = MediaMTXMoQReader.#readVarintFromBytes(payload, off);
+    off += v.size;
+    return new TextDecoder().decode(payload.slice(off, off + Number(v.value)));
+  }
+
+  async #readSubGroup(readable) {
+    const r = new MediaMTXMoQReader.#StreamReader(readable);
+    const streamType = await r.readVarint();
+    if (
+      (streamType & MediaMTXMoQReader.#SUBGROUP_TYPE_MASK) !==
+      MediaMTXMoQReader.#SUBGROUP_TYPE_BITS
+    ) {
+      throw new Error("not a subgroup stream");
+    }
+    const withProps =
+      (streamType & MediaMTXMoQReader.#SUBGROUP_PROPS_BIT) !== 0n;
+
+    const trackAlias = await r.readVarint();
+    const groupId = await r.readVarint();
+
+    await r.readVarint(); // idDelta
+    if (withProps) {
+      const propsLen = await r.readVarint();
+      if (propsLen > 0n) await r.readBytes(Number(propsLen));
+    }
+    const len = await r.readVarint();
+    if (len === 0n) {
+      throw new Error("first object has zero length");
+    }
+    const data = await r.readBytes(Number(len));
+
+    await r.readVarint(); // idDelta
+    if (withProps) {
+      const propsLen = await r.readVarint();
+      if (propsLen > 0n) await r.readBytes(Number(propsLen));
+    }
+    const endLen = await r.readVarint();
+    if (endLen !== 0n) {
+      throw new Error("end chunk has non-zero length");
+    }
+
+    return { data, trackAlias, groupId };
+  }
+
+  async #subscribeAllTracks() {
+    const promises = [];
+
+    for (let i = 0; i < this.#catalog.tracks.length; i++) {
+      const track = this.#catalog.tracks[i];
+
+      if (/^(avc3|hev1|av01|vp09|vp8)/.test(track.codec)) {
+        if (this.#videoTrack === null) {
+          this.#videoTrack = track;
+          promises.push(
+            this.#subscribeTrack(MediaMTXMoQReader.#VIDEO_REQUEST_ID, track),
+          );
+        }
+      } else if (/^(opus|mp4a|flac|pcm)/.test(track.codec)) {
+        if (this.#audioTrack === null) {
+          this.#audioTrack = track;
+          promises.push(
+            this.#subscribeTrack(MediaMTXMoQReader.#AUDIO_REQUEST_ID, track),
+          );
+        }
+      } else {
+        throw new Error("unsupported codec: " + track.codec);
+      }
+    }
+
+    await Promise.all(promises);
+
+    if (this.#conf.onSubscribed !== undefined) {
+      this.#conf.onSubscribed(this.#audioTrack !== null);
+    }
+  }
+
+  async #subscribeTrack(requestId, track) {
+    const bidi = await this.#wt.createBidirectionalStream();
+    const w = bidi.writable.getWriter();
+    const r = new MediaMTXMoQReader.#StreamReader(bidi.readable);
+
+    await w.write(
+      MediaMTXMoQReader.#encodeMsg(
+        MediaMTXMoQReader.#MSG_SUBSCRIBE,
+        MediaMTXMoQReader.#concat(
+          MediaMTXMoQReader.#encodeVarint(requestId),
+          MediaMTXMoQReader.#encodeNamespace(MediaMTXMoQReader.#NAMESPACE),
+          MediaMTXMoQReader.#encodeString(track.name),
+          this.#encodeAuthParams(),
+        ),
+      ),
+    );
+    w.releaseLock();
+
+    const t = await r.readVarint();
+    if (t !== MediaMTXMoQReader.#MSG_SUBSCRIBE_OK) {
+      throw new Error("expected SUBSCRIBE_OK, got 0x" + t.toString(16));
+    }
+    await r.readBytes(await r.readU16());
+
+    if (requestId === MediaMTXMoQReader.#VIDEO_REQUEST_ID) {
+      this.#videoCanvas = document.createElement("canvas");
+      this.#conf.videoElement.appendChild(this.#videoCanvas);
+
+      const ctxGL = this.#videoCanvas.getContext("webgl2", {
+        desynchronized: true,
+        powerPreference: "high-performance",
+      });
+
+      let ctx2D = null;
+      if (ctxGL === null) {
+        console.log("video renderer: 2D canvas");
+
+        ctx2D = this.#videoCanvas.getContext("2d");
+      } else {
+        console.log("video renderer: WebGL2");
+
+        const vert = ctxGL.createShader(ctxGL.VERTEX_SHADER);
+        ctxGL.shaderSource(
+          vert,
+          `#version 300 es
+          in vec2 a_pos;
+          out vec2 v_uv;
+          void main() {
+            v_uv = vec2(a_pos.x * 0.5 + 0.5, 0.5 - a_pos.y * 0.5);
+            gl_Position = vec4(a_pos, 0, 1);
+          }
+        `,
+        );
+        ctxGL.compileShader(vert);
+
+        const frag = ctxGL.createShader(ctxGL.FRAGMENT_SHADER);
+        ctxGL.shaderSource(
+          frag,
+          `#version 300 es
+          precision mediump float;
+          uniform sampler2D u_tex;
+          in vec2 v_uv;
+          out vec4 color;
+          void main() { color = texture(u_tex, v_uv); }
+        `,
+        );
+        ctxGL.compileShader(frag);
+
+        const prog = ctxGL.createProgram();
+        ctxGL.attachShader(prog, vert);
+        ctxGL.attachShader(prog, frag);
+        ctxGL.linkProgram(prog);
+        ctxGL.useProgram(prog);
+
+        const buf = ctxGL.createBuffer();
+        ctxGL.bindBuffer(ctxGL.ARRAY_BUFFER, buf);
+        ctxGL.bufferData(
+          ctxGL.ARRAY_BUFFER,
+          new Float32Array([-1, -1, 1, -1, -1, 1, 1, 1]),
+          ctxGL.STATIC_DRAW,
+        );
+        const loc = ctxGL.getAttribLocation(prog, "a_pos");
+        ctxGL.enableVertexAttribArray(loc);
+        ctxGL.vertexAttribPointer(loc, 2, ctxGL.FLOAT, false, 0, 0);
+
+        const tex = ctxGL.createTexture();
+        ctxGL.bindTexture(ctxGL.TEXTURE_2D, tex);
+        ctxGL.texParameteri(
+          ctxGL.TEXTURE_2D,
+          ctxGL.TEXTURE_MIN_FILTER,
+          ctxGL.LINEAR,
+        );
+        ctxGL.texParameteri(
+          ctxGL.TEXTURE_2D,
+          ctxGL.TEXTURE_MAG_FILTER,
+          ctxGL.LINEAR,
+        );
+        ctxGL.texParameteri(
+          ctxGL.TEXTURE_2D,
+          ctxGL.TEXTURE_WRAP_S,
+          ctxGL.CLAMP_TO_EDGE,
+        );
+        ctxGL.texParameteri(
+          ctxGL.TEXTURE_2D,
+          ctxGL.TEXTURE_WRAP_T,
+          ctxGL.CLAMP_TO_EDGE,
+        );
+        ctxGL.uniform1i(ctxGL.getUniformLocation(prog, "u_tex"), 0);
+      }
+
+      this.#videoDecoder = new VideoDecoder({
+        output: (frame) => {
+          if (
+            this.#videoCanvas.width !== frame.displayWidth ||
+            this.#videoCanvas.height !== frame.displayHeight
+          ) {
+            this.#videoCanvas.width = frame.displayWidth;
+            this.#videoCanvas.height = frame.displayHeight;
+
+            if (ctxGL !== null) {
+              ctxGL.viewport(
+                0,
+                0,
+                this.#videoCanvas.width,
+                this.#videoCanvas.height,
+              );
+            }
+          }
+
+          if (ctxGL !== null) {
+            ctxGL.texImage2D(
+              ctxGL.TEXTURE_2D,
+              0,
+              ctxGL.RGBA,
+              ctxGL.RGBA,
+              ctxGL.UNSIGNED_BYTE,
+              frame,
+            );
+            ctxGL.drawArrays(ctxGL.TRIANGLE_STRIP, 0, 4);
+          } else {
+            ctx2D.drawImage(frame, 0, 0);
+          }
+
+          frame.close();
+        },
+        error: (err) => console.error(err.message),
+      });
+
+      const config = {
+        codec: track.codec,
+        optimizeForLatency: true,
+      };
+
+      const supported = await VideoDecoder.isConfigSupported(config);
+      if (!supported.supported) {
+        throw new Error(
+          "the browser you are using does not support video codec " +
+            track.codec,
+        );
+      }
+
+      this.#videoDecoder.configure(config);
+
+      this.#videoReorderer = new MediaMTXMoQReader.#Reorderer(
+        MediaMTXMoQReader.#MAX_VIDEO_REORDERED_SUBGROUPS,
+      );
+    } else {
+      this.#audioCtx = new AudioContext();
+
+      if (
+        this.#audioCtx.state === "suspended" &&
+        this.#conf.onAudioMuted !== undefined
+      ) {
+        this.#conf.onAudioMuted(true);
+      }
+
+      let playbackTime = null;
+
+      this.#audioDecoder = new AudioDecoder({
+        output: async (data) => {
+          try {
+            if (this.#audioCtx.state === "running") {
+              const buf = this.#audioCtx.createBuffer(
+                data.numberOfChannels,
+                data.numberOfFrames,
+                data.sampleRate,
+              );
+
+              for (let ch = 0; ch < data.numberOfChannels; ch++) {
+                data.copyTo(buf.getChannelData(ch), {
+                  planeIndex: ch,
+                  format: "f32-planar",
+                });
+              }
+
+              const src = this.#audioCtx.createBufferSource();
+              src.buffer = buf;
+              src.connect(this.#audioCtx.destination);
+
+              if (
+                playbackTime === null ||
+                playbackTime < this.#audioCtx.currentTime ||
+                playbackTime >
+                  this.#audioCtx.currentTime +
+                    MediaMTXMoQReader.#AUDIO_MAX_LATENCY_SECS
+              ) {
+                if (playbackTime !== null) {
+                  console.info(
+                    "audio desync detected (currentTime=" +
+                      this.#audioCtx.currentTime.toFixed(3) +
+                      " playbackTime=" +
+                      playbackTime.toFixed(3) +
+                      ") - resetting playback time",
+                  );
+                }
+                playbackTime =
+                  this.#audioCtx.currentTime +
+                  MediaMTXMoQReader.#AUDIO_START_LATENCY_SECS;
+              }
+
+              src.start(playbackTime);
+
+              playbackTime += buf.duration;
+            }
+          } finally {
+            data.close();
+          }
+        },
+        error: (err) => console.error(err.message),
+      });
+
+      const config = {
+        codec: track.codec,
+        sampleRate: track.samplerate,
+        numberOfChannels: track.channels,
+      };
+      if (track.initData) {
+        config.description = MediaMTXMoQReader.#base64ToBuffer(track.initData);
+      }
+
+      this.#audioDecoder.configure(config);
+
+      this.#audioReorderer = new MediaMTXMoQReader.#Reorderer(
+        MediaMTXMoQReader.#MAX_AUDIO_REORDERED_SUBGROUPS,
+      );
+    }
+
+    console.log("subscribed track " + track.name + " (" + track.codec + ")");
+  }
+
+  async #drainDataStreams() {
+    for (;;) {
+      const stream = await this.#nextUni();
+      this.#onDataTrack(stream).catch((err) => this.#handleError(err.message));
+    }
+  }
+
+  async #onDataTrack(readable) {
+    const { data, trackAlias, groupId } = await this.#readSubGroup(readable);
+    if (data.length === 0) {
+      return;
+    }
+
+    if (trackAlias === MediaMTXMoQReader.#VIDEO_REQUEST_ID) {
+      const sgs = this.#videoReorderer.push(data, groupId);
+
+      for (const sg of sgs) {
+        this.#decodeVideo(sg.data, sg.groupId);
+      }
+    } else {
+      const sgs = this.#audioReorderer.push(data, groupId);
+
+      for (const sg of sgs) {
+        this.#decodeAudio(sg.data, sg.groupId);
+      }
+    }
+  }
+
+  #decodeVideo(data, groupId) {
+    // this happens when the screen is off
+    if (
+      this.#videoDecoder.decodeQueueSize >=
+      MediaMTXMoQReader.#MAX_VIDEO_FRAMES_IN_DECODER
+    ) {
+      console.log("skipping video frame, decode queue is full");
+      return;
+    }
+
+    if (/^(avc3)/.test(this.#videoTrack.codec)) {
+      let sps = null;
+      let pps = null;
+      for (const nalu of MediaMTXMoQReader.#splitAVCC(data)) {
+        const naluType = nalu[0] & 0x1f;
+        if (naluType === 7) {
+          sps = nalu;
+        } else if (naluType === 8) {
+          pps = nalu;
+        }
+      }
+
+      if (
+        sps !== null &&
+        pps !== null &&
+        (this.#videoParams === null ||
+          !MediaMTXMoQReader.#bytesEqual(this.#videoParams.sps, sps) ||
+          !MediaMTXMoQReader.#bytesEqual(this.#videoParams.pps, pps))
+      ) {
+        this.#videoParams = { sps, pps };
+        this.#videoDecoder.configure({
+          codec: this.#videoTrack.codec,
+          optimizeForLatency: true,
+          description: MediaMTXMoQReader.#makeAvcC(sps, pps),
+        });
+        console.log("video params updated");
+      }
+    } else if (/^(hev1)/.test(this.#videoTrack.codec)) {
+      let vps = null;
+      let sps = null;
+      let pps = null;
+      for (const nalu of MediaMTXMoQReader.#splitAVCC(data)) {
+        const naluType = (nalu[0] >> 1) & 0x3f;
+        if (naluType === 32) {
+          vps = nalu;
+        } else if (naluType === 33) {
+          sps = nalu;
+        } else if (naluType === 34) {
+          pps = nalu;
+        }
+      }
+
+      if (
+        vps !== null &&
+        sps !== null &&
+        pps !== null &&
+        (this.#videoParams === null ||
+          !MediaMTXMoQReader.#bytesEqual(this.#videoParams.vps, vps) ||
+          !MediaMTXMoQReader.#bytesEqual(this.#videoParams.sps, sps) ||
+          !MediaMTXMoQReader.#bytesEqual(this.#videoParams.pps, pps))
+      ) {
+        this.#videoParams = { vps, sps, pps };
+        this.#videoDecoder.configure({
+          codec: this.#videoTrack.codec,
+          optimizeForLatency: true,
+          description: MediaMTXMoQReader.#makeHvcC(vps, sps, pps),
+        });
+        console.log("video params updated");
+      }
+    }
+
+    const timestamp = performance.now() * 1000;
+    this.#videoDecoder.decode(
+      new EncodedVideoChunk({ type: "key", timestamp, data }),
+    );
+  }
+
+  #decodeAudio(data, groupId) {
+    // this happens when the screen is off
+    if (
+      this.#audioDecoder.decodeQueueSize >=
+      MediaMTXMoQReader.#MAX_AUDIO_FRAMES_IN_DECODER
+    ) {
+      console.log("skipping audio frame, decode queue is full");
+      return;
+    }
+
+    const timestamp = Number(groupId);
+    this.#audioDecoder.decode(
+      new EncodedAudioChunk({ type: "key", timestamp, data }),
+    );
+  }
+
+  static #makeAvcC(sps, pps) {
+    const avcC = new Uint8Array(11 + sps.length + pps.length);
+    let off = 0;
+    avcC[off++] = 0x01; // configurationVersion
+    avcC[off++] = sps[1]; // AVCProfileIndication
+    avcC[off++] = sps[2]; // profile_compatibility
+    avcC[off++] = sps[3]; // AVCLevelIndication
+    avcC[off++] = 0xff; // reserved + lengthSizeMinusOne=3
+    avcC[off++] = 0xe1; // reserved + numSPS=1
+    avcC[off++] = (sps.length >> 8) & 0xff;
+    avcC[off++] = sps.length & 0xff;
+    avcC.set(sps, off);
+    off += sps.length;
+    avcC[off++] = 0x01; // numPPS=1
+    avcC[off++] = (pps.length >> 8) & 0xff;
+    avcC[off++] = pps.length & 0xff;
+    avcC.set(pps, off);
+    return avcC;
+  }
+
+  static #makeHvcC(vps, sps, pps) {
+    // Extract profile/level from SPS NALU:
+    //   bytes 0-1: NALU header
+    //   byte 2: sps_vps_id(4) | sps_max_sub_layers_minus1(3) | sps_temporal_id_nesting_flag(1)
+    //   bytes 3-14: profile_tier_level general portion (12 bytes)
+    const numTemporalLayers = ((sps[2] >> 1) & 0x7) + 1;
+    const temporalIdNested = sps[2] & 0x1;
+    const arrays = [
+      { type: 32, nalu: vps }, // VPS
+      { type: 33, nalu: sps }, // SPS
+      { type: 34, nalu: pps }, // PPS
+    ];
+    const totalSize = 23 + arrays.reduce((n, a) => n + 5 + a.nalu.length, 0);
+    const hvcC = new Uint8Array(totalSize);
+    let off = 0;
+    hvcC[off++] = 0x01; // configurationVersion
+    hvcC[off++] = sps[3]; // general_profile_space(2)|general_tier_flag(1)|general_profile_idc(5)
+    hvcC[off++] = sps[4]; // general_profile_compatibility_flags
+    hvcC[off++] = sps[5];
+    hvcC[off++] = sps[6];
+    hvcC[off++] = sps[7];
+    hvcC[off++] = sps[8]; // general_constraint_indicator_flags
+    hvcC[off++] = sps[9];
+    hvcC[off++] = sps[10];
+    hvcC[off++] = sps[11];
+    hvcC[off++] = sps[12];
+    hvcC[off++] = sps[13];
+    hvcC[off++] = sps[14]; // general_level_idc
+    hvcC[off++] = 0xf0; // reserved(4) | min_spatial_segmentation_idc[11:8]
+    hvcC[off++] = 0x00; // min_spatial_segmentation_idc[7:0]
+    hvcC[off++] = 0xfc; // reserved(6) | parallelismType(2)
+    hvcC[off++] = 0xfd; // reserved(6) | chromaFormat=1 (4:2:0)
+    hvcC[off++] = 0xf8; // reserved(5) | bitDepthLumaMinus8=0
+    hvcC[off++] = 0xf8; // reserved(5) | bitDepthChromaMinus8=0
+    hvcC[off++] = 0x00; // avgFrameRate
+    hvcC[off++] = 0x00;
+    // constantFrameRate(2)=0 | numTemporalLayers(3) | temporalIdNested(1) | lengthSizeMinusOne(2)=3
+    hvcC[off++] =
+      ((numTemporalLayers & 0x7) << 3) | ((temporalIdNested & 0x1) << 2) | 0x03;
+    hvcC[off++] = arrays.length; // numOfArrays
+    for (const { type, nalu } of arrays) {
+      hvcC[off++] = 0x80 | (type & 0x3f); // array_completeness=1 | reserved | NAL_unit_type
+      hvcC[off++] = 0x00; // numNalus high
+      hvcC[off++] = 0x01; // numNalus low = 1
+      hvcC[off++] = (nalu.length >> 8) & 0xff;
+      hvcC[off++] = nalu.length & 0xff;
+      hvcC.set(nalu, off);
+      off += nalu.length;
+    }
+    return hvcC;
+  }
+
+  static #encodeVarint(value) {
+    const v = BigInt(value);
+    if (v < 128n) {
+      return new Uint8Array([Number(v)]);
+    }
+    if (v < 16384n) {
+      return new Uint8Array([0x80 | Number(v >> 8n), Number(v & 0xffn)]);
+    }
+    if (v < 2097152n) {
+      return new Uint8Array([
+        0xc0 | Number(v >> 16n),
+        Number((v >> 8n) & 0xffn),
+        Number(v & 0xffn),
+      ]);
+    }
+    if (v < 268435456n) {
+      return new Uint8Array([
+        0xe0 | Number(v >> 24n),
+        Number((v >> 16n) & 0xffn),
+        Number((v >> 8n) & 0xffn),
+        Number(v & 0xffn),
+      ]);
+    }
+    if (v < 34359738368n) {
+      return new Uint8Array([
+        0xf0 | Number(v >> 32n),
+        Number((v >> 24n) & 0xffn),
+        Number((v >> 16n) & 0xffn),
+        Number((v >> 8n) & 0xffn),
+        Number(v & 0xffn),
+      ]);
+    }
+    if (v < 4398046511104n) {
+      return new Uint8Array([
+        0xf8 | Number(v >> 40n),
+        Number((v >> 32n) & 0xffn),
+        Number((v >> 24n) & 0xffn),
+        Number((v >> 16n) & 0xffn),
+        Number((v >> 8n) & 0xffn),
+        Number(v & 0xffn),
+      ]);
+    }
+    if (v < 562949953421312n) {
+      return new Uint8Array([
+        0xfc | Number(v >> 48n),
+        Number((v >> 40n) & 0xffn),
+        Number((v >> 32n) & 0xffn),
+        Number((v >> 24n) & 0xffn),
+        Number((v >> 16n) & 0xffn),
+        Number((v >> 8n) & 0xffn),
+        Number(v & 0xffn),
+      ]);
+    }
+    if (v < 72057594037927936n) {
+      return new Uint8Array([
+        0xfe,
+        Number((v >> 48n) & 0xffn),
+        Number((v >> 40n) & 0xffn),
+        Number((v >> 32n) & 0xffn),
+        Number((v >> 24n) & 0xffn),
+        Number((v >> 16n) & 0xffn),
+        Number((v >> 8n) & 0xffn),
+        Number(v & 0xffn),
+      ]);
+    }
+    return new Uint8Array([
+      0xff,
+      Number((v >> 56n) & 0xffn),
+      Number((v >> 48n) & 0xffn),
+      Number((v >> 40n) & 0xffn),
+      Number((v >> 32n) & 0xffn),
+      Number((v >> 24n) & 0xffn),
+      Number((v >> 16n) & 0xffn),
+      Number((v >> 8n) & 0xffn),
+      Number(v & 0xffn),
+    ]);
+  }
+
+  static #concat(...arrays) {
+    const total = arrays.reduce((n, a) => n + a.length, 0);
+    const out = new Uint8Array(total);
+    let pos = 0;
+    for (const a of arrays) {
+      out.set(a, pos);
+      pos += a.length;
+    }
+    return out;
+  }
+
+  static #encodeString(s) {
+    const b = new TextEncoder().encode(s);
+    return MediaMTXMoQReader.#concat(
+      MediaMTXMoQReader.#encodeVarint(b.length),
+      b,
+    );
+  }
+
+  static #encodeNamespace(parts) {
+    let b = MediaMTXMoQReader.#encodeVarint(parts.length);
+    for (const p of parts)
+      b = MediaMTXMoQReader.#concat(b, MediaMTXMoQReader.#encodeString(p));
+    return b;
+  }
+
+  static #encodeMsg(type, payload) {
+    return MediaMTXMoQReader.#concat(
+      MediaMTXMoQReader.#encodeVarint(type),
+      new Uint8Array([(payload.length >> 8) & 0xff, payload.length & 0xff]),
+      payload,
+    );
+  }
+
+  static #splitAVCC(data) {
+    const nalus = [];
+    let i = 0;
+    while (i + 4 <= data.length) {
+      const len =
+        (data[i] << 24) |
+        (data[i + 1] << 16) |
+        (data[i + 2] << 8) |
+        data[i + 3];
+      i += 4;
+      if (len <= 0 || i + len > data.length) break;
+      nalus.push(data.slice(i, i + len));
+      i += len;
+    }
+    return nalus;
+  }
+
+  static #base64ToBuffer(b64) {
+    const bin = atob(b64);
+    const buf = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++) buf[i] = bin.charCodeAt(i);
+    return buf;
+  }
+
+  static #bytesEqual(a, b) {
+    if (a.length !== b.length) {
+      return false;
+    }
+    for (let i = 0; i < a.length; i++) {
+      if (a[i] !== b[i]) {
+        return false;
+      }
+    }
+    return true;
+  }
+
+  static #Reorderer = class {
+    #maxReorderered;
+    #curGroupId = null;
+    #pending = new Map();
+
+    constructor(maxReorderered) {
+      this.#maxReorderered = maxReorderered;
+    }
+
+    push(data, groupId) {
+      if (this.#curGroupId === null) {
+        this.#curGroupId = groupId;
+        return [{ data, groupId }];
+      } else if (groupId <= this.#curGroupId) {
+        console.log("skipping out-of-order subgroup");
+      } else if (
+        groupId === this.#curGroupId + 1n &&
+        this.#pending.size === 0
+      ) {
+        this.#curGroupId = groupId;
+        return [{ data, groupId }];
+      } else {
+        this.#pending.set(groupId, data);
+
+        const diff = groupId - this.#curGroupId;
+
+        let countInRange = 0n;
+        for (const id of this.#pending.keys()) {
+          if (id <= groupId) {
+            countInRange++;
+          }
+        }
+
+        if (countInRange === diff) {
+          return this.#flushUpTo(groupId);
+        } else if (this.#pending.size > this.#maxReorderered) {
+          console.log("too many reordered subgroups, flushing");
+          return this.#flushUpTo(groupId);
+        }
+      }
+      return [];
+    }
+
+    // Flushes pending items from curGroupId+1 through maxGroupId (skipping
+    // gaps), advances curGroupId, then drains any further consecutive items
+    // already in pending so they are not stranded.
+    #flushUpTo(maxGroupId) {
+      const out = [];
+      for (let i = this.#curGroupId + 1n; i <= maxGroupId; i++) {
+        const d = this.#pending.get(i);
+        if (d !== undefined) {
+          out.push({ data: d, groupId: i });
+          this.#pending.delete(i);
+        }
+      }
+      this.#curGroupId = maxGroupId;
+      for (;;) {
+        const next = this.#pending.get(this.#curGroupId + 1n);
+        if (next === undefined) break;
+        this.#curGroupId += 1n;
+        out.push({ data: next, groupId: this.#curGroupId });
+        this.#pending.delete(this.#curGroupId);
+      }
+      return out;
+    }
+  };
+
+  static #StreamReader = class {
+    #reader = null;
+    #buf = new Uint8Array(0);
+
+    constructor(src) {
+      this.#reader = src.getReader();
+    }
+
+    async #fill() {
+      if (!this.#reader) {
+        throw new Error("stream ended");
+      }
+      const { value, done } = await this.#reader.read();
+      if (done) {
+        throw new Error("stream ended");
+      }
+      const next = new Uint8Array(this.#buf.length + value.length);
+      next.set(this.#buf);
+      next.set(value, this.#buf.length);
+      this.#buf = next;
+    }
+
+    async readBytes(n) {
+      while (this.#buf.length < n) await this.#fill();
+      const out = this.#buf.slice(0, n);
+      this.#buf = this.#buf.slice(n);
+      return out;
+    }
+
+    async readVarint() {
+      while (this.#buf.length < 1) await this.#fill();
+      const b = this.#buf[0];
+      let size;
+      if ((b & 0x80) === 0) {
+        size = 1;
+      } else if ((b & 0xc0) === 0x80) {
+        size = 2;
+      } else if ((b & 0xe0) === 0xc0) {
+        size = 3;
+      } else if ((b & 0xf0) === 0xe0) {
+        size = 4;
+      } else if ((b & 0xf8) === 0xf0) {
+        size = 5;
+      } else if ((b & 0xfc) === 0xf8) {
+        size = 6;
+      } else if ((b & 0xfe) === 0xfc) {
+        size = 7;
+      } else if (b === 0xfe) {
+        size = 8;
+      } else {
+        size = 9; // b === 0xff
+      }
+      const d = await this.readBytes(size);
+      switch (size) {
+        case 1:
+          return BigInt(d[0]);
+        case 2:
+          return BigInt(((d[0] & 0x3f) << 8) | d[1]);
+        case 3:
+          return BigInt(((d[0] & 0x1f) << 16) | (d[1] << 8) | d[2]);
+        case 4:
+          return BigInt(
+            ((d[0] & 0x0f) << 24) | (d[1] << 16) | (d[2] << 8) | d[3],
+          );
+        case 5:
+          return (
+            (BigInt(d[0] & 0x07) << 32n) |
+            (BigInt(d[1]) << 24n) |
+            (BigInt(d[2]) << 16n) |
+            (BigInt(d[3]) << 8n) |
+            BigInt(d[4])
+          );
+        case 6:
+          return (
+            (BigInt(d[0] & 0x03) << 40n) |
+            (BigInt(d[1]) << 32n) |
+            (BigInt(d[2]) << 24n) |
+            (BigInt(d[3]) << 16n) |
+            (BigInt(d[4]) << 8n) |
+            BigInt(d[5])
+          );
+        case 7:
+          return (
+            (BigInt(d[0] & 0x01) << 48n) |
+            (BigInt(d[1]) << 40n) |
+            (BigInt(d[2]) << 32n) |
+            (BigInt(d[3]) << 24n) |
+            (BigInt(d[4]) << 16n) |
+            (BigInt(d[5]) << 8n) |
+            BigInt(d[6])
+          );
+        case 8:
+          return (
+            (BigInt(d[1]) << 48n) |
+            (BigInt(d[2]) << 40n) |
+            (BigInt(d[3]) << 32n) |
+            (BigInt(d[4]) << 24n) |
+            (BigInt(d[5]) << 16n) |
+            (BigInt(d[6]) << 8n) |
+            BigInt(d[7])
+          );
+        default: // 9
+          return (
+            (BigInt(d[1]) << 56n) |
+            (BigInt(d[2]) << 48n) |
+            (BigInt(d[3]) << 40n) |
+            (BigInt(d[4]) << 32n) |
+            (BigInt(d[5]) << 24n) |
+            (BigInt(d[6]) << 16n) |
+            (BigInt(d[7]) << 8n) |
+            BigInt(d[8])
+          );
+      }
+    }
+
+    async readU16() {
+      const d = await this.readBytes(2);
+      return (d[0] << 8) | d[1];
+    }
+  };
+}
+
+window.MediaMTXMoQReader = MediaMTXMoQReader;
diff --git a/internal/servers/moq/server.go b/internal/servers/moq/server.go
new file mode 100644
index 00000000..3aab1dc6
--- /dev/null
+++ b/internal/servers/moq/server.go
@@ -0,0 +1,304 @@
+// Package moq contains a Media over QUIC server.
+package moq
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"reflect"
+	"sync"
+
+	"github.com/bluenviron/mediamtx/internal/conf"
+	"github.com/bluenviron/mediamtx/internal/defs"
+	"github.com/bluenviron/mediamtx/internal/logger"
+	"github.com/google/uuid"
+	"github.com/quic-go/webtransport-go"
+)
+
+// ErrSessionNotFound is returned when a session is not found.
+var ErrSessionNotFound = errors.New("session not found")
+
+func interfaceIsEmpty(i any) bool {
+	return reflect.ValueOf(i).Kind() != reflect.Pointer || reflect.ValueOf(i).IsNil()
+}
+
+type serverPathManager interface {
+	FindPathConf(req defs.PathFindPathConfReq) (*defs.PathFindPathConfRes, error)
+	AddReader(req defs.PathAddReaderReq) (*defs.PathAddReaderRes, error)
+	AddPublisher(req defs.PathAddPublisherReq) (*defs.PathAddPublisherRes, error)
+}
+
+type newSessionRes struct {
+	sx  *session
+	err error
+}
+
+type newSessionReq struct {
+	pathName  string
+	query     string
+	userAgent string
+	wt        *webtransport.Session
+	res       chan newSessionRes
+}
+
+type serverAPISessionsListRes struct {
+	data *defs.APIMoQSessionList
+}
+
+type serverAPISessionsListReq struct {
+	res chan serverAPISessionsListRes
+}
+
+type serverAPISessionsGetRes struct {
+	data *defs.APIMoQSession
+	err  error
+}
+
+type serverAPISessionsGetReq struct {
+	uuid uuid.UUID
+	res  chan serverAPISessionsGetRes
+}
+
+type serverAPISessionsKickRes struct {
+	err error
+}
+
+type serverAPISessionsKickReq struct {
+	uuid uuid.UUID
+	res  chan serverAPISessionsKickRes
+}
+
+type serverParent interface {
+	logger.Writer
+}
+
+type serverMetrics interface {
+	SetMoQServer(defs.APIMoQServer)
+}
+
+// Server is a Media over QUIC server.
+type Server struct {
+	HTTPS2Address     string
+	HTTPS3Address     string
+	ServerKey         string
+	ServerCert        string
+	AllowOrigins      []string
+	UDPReadBufferSize uint
+	TrustedProxies    conf.IPNetworks
+	ReadTimeout       conf.Duration
+	WriteTimeout      conf.Duration
+	PathManager       serverPathManager
+	Metrics           serverMetrics
+	Parent            serverParent
+
+	ctx        context.Context
+	ctxCancel  context.CancelFunc
+	httpServer *httpServer
+	sessions   map[*session]struct{}
+
+	chNewSession      chan newSessionReq
+	chCloseSession    chan *session
+	chAPISessionsList chan serverAPISessionsListReq
+	chAPISessionsGet  chan serverAPISessionsGetReq
+	chAPISessionsKick chan serverAPISessionsKickReq
+	done              chan struct{}
+}
+
+// Initialize initializes the server.
+func (s *Server) Initialize() error {
+	s.httpServer = &httpServer{
+		https2Address:     s.HTTPS2Address,
+		https3Address:     s.HTTPS3Address,
+		serverKey:         s.ServerKey,
+		serverCert:        s.ServerCert,
+		allowOrigins:      s.AllowOrigins,
+		trustedProxies:    s.TrustedProxies,
+		udpReadBufferSize: s.UDPReadBufferSize,
+		readTimeout:       s.ReadTimeout,
+		writeTimeout:      s.WriteTimeout,
+		pathManager:       s.PathManager,
+		parent:            s,
+	}
+	err := s.httpServer.initialize()
+	if err != nil {
+		return err
+	}
+
+	s.ctx, s.ctxCancel = context.WithCancel(context.Background())
+	s.sessions = make(map[*session]struct{})
+	s.chNewSession = make(chan newSessionReq)
+	s.chCloseSession = make(chan *session)
+	s.chAPISessionsList = make(chan serverAPISessionsListReq)
+	s.chAPISessionsGet = make(chan serverAPISessionsGetReq)
+	s.chAPISessionsKick = make(chan serverAPISessionsKickReq)
+	s.done = make(chan struct{})
+
+	s.Log(logger.Info, "started with listeners on %s (TCP/HTTPS2), %s (UDP/HTTP3)", s.HTTPS2Address, s.HTTPS3Address)
+
+	go s.run()
+
+	if !interfaceIsEmpty(s.Metrics) {
+		s.Metrics.SetMoQServer(s)
+	}
+
+	return nil
+}
+
+// Log implements logger.Writer.
+func (s *Server) Log(level logger.Level, format string, args ...any) {
+	s.Parent.Log(level, "[MoQ] "+format, args...)
+}
+
+// Close closes the server.
+func (s *Server) Close() {
+	s.Log(logger.Info, "closing")
+
+	if !interfaceIsEmpty(s.Metrics) {
+		s.Metrics.SetMoQServer(nil)
+	}
+
+	s.ctxCancel()
+	<-s.done
+}
+
+func (s *Server) run() {
+	defer close(s.done)
+
+	var wg sync.WaitGroup
+
+outer:
+	for {
+		select {
+		case req := <-s.chNewSession:
+			sx := &session{
+				wt:          req.wt,
+				wg:          &wg,
+				pathName:    req.pathName,
+				query:       req.query,
+				userAgent:   req.userAgent,
+				pathManager: s.PathManager,
+				parent:      s,
+			}
+			sx.initialize()
+			s.sessions[sx] = struct{}{}
+			req.res <- newSessionRes{sx: sx}
+
+		case sx := <-s.chCloseSession:
+			delete(s.sessions, sx)
+
+		case req := <-s.chAPISessionsList:
+			data := &defs.APIMoQSessionList{
+				Items: []defs.APIMoQSession{},
+			}
+			for sx := range s.sessions {
+				data.Items = append(data.Items, sx.apiItem())
+			}
+			req.res <- serverAPISessionsListRes{data: data}
+
+		case req := <-s.chAPISessionsGet:
+			var found *session
+			for sx := range s.sessions {
+				if sx.uuid == req.uuid {
+					found = sx
+					break
+				}
+			}
+			if found == nil {
+				req.res <- serverAPISessionsGetRes{err: ErrSessionNotFound}
+			} else {
+				item := found.apiItem()
+				req.res <- serverAPISessionsGetRes{data: &item}
+			}
+
+		case req := <-s.chAPISessionsKick:
+			var found *session
+			for sx := range s.sessions {
+				if sx.uuid == req.uuid {
+					found = sx
+					break
+				}
+			}
+			if found == nil {
+				req.res <- serverAPISessionsKickRes{err: ErrSessionNotFound}
+			} else {
+				found.Close()
+				req.res <- serverAPISessionsKickRes{}
+			}
+
+		case <-s.ctx.Done():
+			break outer
+		}
+	}
+
+	// close sessions before closing UDP packet listener
+	for sx := range s.sessions {
+		sx.Close()
+	}
+
+	s.httpServer.close()
+
+	wg.Wait()
+}
+
+func (s *Server) newSession(req newSessionReq) newSessionRes {
+	req.res = make(chan newSessionRes)
+
+	select {
+	case s.chNewSession <- req:
+		return <-req.res
+	case <-s.ctx.Done():
+		return newSessionRes{err: fmt.Errorf("terminated")}
+	}
+}
+
+// closeSession is called by session.
+func (s *Server) closeSession(sx *session) {
+	select {
+	case s.chCloseSession <- sx:
+	case <-s.ctx.Done():
+	}
+}
+
+// APISessionsList implements defs.APIMoQServer.
+func (s *Server) APISessionsList() (*defs.APIMoQSessionList, error) {
+	req := serverAPISessionsListReq{
+		res: make(chan serverAPISessionsListRes),
+	}
+	select {
+	case s.chAPISessionsList <- req:
+		res := <-req.res
+		return res.data, nil
+	case <-s.ctx.Done():
+		return nil, fmt.Errorf("terminated")
+	}
+}
+
+// APISessionsGet implements defs.APIMoQServer.
+func (s *Server) APISessionsGet(id uuid.UUID) (*defs.APIMoQSession, error) {
+	req := serverAPISessionsGetReq{
+		uuid: id,
+		res:  make(chan serverAPISessionsGetRes),
+	}
+	select {
+	case s.chAPISessionsGet <- req:
+		res := <-req.res
+		return res.data, res.err
+	case <-s.ctx.Done():
+		return nil, fmt.Errorf("terminated")
+	}
+}
+
+// APISessionsKick implements defs.APIMoQServer.
+func (s *Server) APISessionsKick(id uuid.UUID) error {
+	req := serverAPISessionsKickReq{
+		uuid: id,
+		res:  make(chan serverAPISessionsKickRes),
+	}
+	select {
+	case s.chAPISessionsKick <- req:
+		res := <-req.res
+		return res.err
+	case <-s.ctx.Done():
+		return fmt.Errorf("terminated")
+	}
+}
diff --git a/internal/servers/moq/server_test.go b/internal/servers/moq/server_test.go
new file mode 100644
index 00000000..8244998e
--- /dev/null
+++ b/internal/servers/moq/server_test.go
@@ -0,0 +1,179 @@
+package moq
+
+import (
+	"context"
+	"crypto/tls"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/bluenviron/gortsplib/v5/pkg/description"
+	mch264 "github.com/bluenviron/mediacommon/v2/pkg/codecs/h264"
+	"github.com/bluenviron/mediamtx/internal/conf"
+	"github.com/bluenviron/mediamtx/internal/defs"
+	"github.com/bluenviron/mediamtx/internal/externalcmd"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/catalog"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/controlmessage"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/subgroup"
+	"github.com/bluenviron/mediamtx/internal/stream"
+	"github.com/bluenviron/mediamtx/internal/test"
+	"github.com/bluenviron/mediamtx/internal/unit"
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/webtransport-go"
+	"github.com/stretchr/testify/require"
+)
+
+type serverDummyPath struct{}
+
+func (p *serverDummyPath) Name() string                                  { return "teststream" }
+func (p *serverDummyPath) SafeConf() *conf.Path                          { return &conf.Path{} }
+func (p *serverDummyPath) ExternalCmdEnv() externalcmd.Environment       { return externalcmd.Environment{} }
+func (p *serverDummyPath) RemovePublisher(_ defs.PathRemovePublisherReq) {}
+func (p *serverDummyPath) RemoveReader(_ defs.PathRemoveReaderReq)       {}
+
+func TestServer(t *testing.T) {
+	desc := &description.Session{Medias: []*description.Media{test.UniqueMediaH264()}}
+	strm := &stream.Stream{
+		Desc:              desc,
+		WriteQueueSize:    512,
+		RTPMaxPayloadSize: 1450,
+		Parent:            test.NilLogger,
+	}
+	err := strm.Initialize()
+	require.NoError(t, err)
+	defer strm.Close()
+
+	subStream := &stream.SubStream{
+		Stream:        strm,
+		UseRTPPackets: false,
+	}
+	err = subStream.Initialize()
+	require.NoError(t, err)
+
+	pm := &test.PathManager{
+		FindPathConfImpl: func(_ defs.PathFindPathConfReq) (*defs.PathFindPathConfRes, error) {
+			return &defs.PathFindPathConfRes{Conf: &conf.Path{}}, nil
+		},
+		AddReaderImpl: func(_ defs.PathAddReaderReq) (*defs.PathAddReaderRes, error) {
+			return &defs.PathAddReaderRes{Path: &serverDummyPath{}, Stream: strm}, nil
+		},
+	}
+
+	serverCertFile := test.CreateTempFile(t, test.TLSCertPub)
+	serverKeyFile := test.CreateTempFile(t, test.TLSCertKey)
+
+	s := &Server{
+		HTTPS2Address:  "127.0.0.1:19895",
+		HTTPS3Address:  "127.0.0.1:19896",
+		ServerCert:     serverCertFile,
+		ServerKey:      serverKeyFile,
+		AllowOrigins:   []string{"*"},
+		TrustedProxies: conf.IPNetworks{},
+		ReadTimeout:    conf.Duration(10 * time.Second),
+		WriteTimeout:   conf.Duration(10 * time.Second),
+		PathManager:    pm,
+		Parent:         test.NilLogger,
+	}
+	err = s.Initialize()
+	require.NoError(t, err)
+	defer s.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	d := &webtransport.Dialer{
+		TLSClientConfig: &tls.Config{
+			InsecureSkipVerify: true, //nolint:gosec
+		},
+		QUICConfig: &quic.Config{
+			EnableDatagrams:                  true,
+			EnableStreamResetPartialDelivery: true,
+		},
+		ApplicationProtocols: []string{"moqt-18"},
+	}
+	defer d.Close() //nolint:errcheck
+
+	res, sx, err := d.Dial(ctx, "https://127.0.0.1:19896/teststream/moq", nil)
+	require.NoError(t, err)
+	defer sx.CloseWithError(0, "") //nolint:errcheck
+	defer res.Body.Close()         //nolint:errcheck
+
+	setupStream, err := sx.AcceptUniStream(ctx)
+	require.NoError(t, err)
+	setupMsg, err := controlmessage.Read(setupStream)
+	require.NoError(t, err)
+	_, ok := setupMsg.(*controlmessage.Setup)
+	require.True(t, ok)
+
+	clientSetup, err := sx.OpenUniStreamSync(ctx)
+	require.NoError(t, err)
+	_, err = clientSetup.Write(controlmessage.Setup{}.Marshal())
+	require.NoError(t, err)
+
+	catalogBidi, err := sx.OpenStreamSync(ctx)
+	require.NoError(t, err)
+	_, err = catalogBidi.Write(controlmessage.Subscribe{
+		RequestID: 1,
+		TrackName: ".catalog",
+	}.Marshal())
+	require.NoError(t, err)
+
+	catalogOkMsg, err := controlmessage.Read(catalogBidi)
+	require.NoError(t, err)
+	catalogOk, ok := catalogOkMsg.(*controlmessage.SubscribeOk)
+	require.True(t, ok)
+	require.Equal(t, uint64(1), catalogOk.TrackAlias)
+
+	catalogDataStream, err := sx.AcceptUniStream(ctx)
+	require.NoError(t, err)
+	var catalogSG subgroup.SubGroup
+	err = catalogSG.Read(catalogDataStream)
+	require.NoError(t, err)
+
+	var cat catalog.Catalog
+	err = json.Unmarshal(catalogSG.Objects[0].Payload, &cat)
+	require.NoError(t, err)
+
+	require.Equal(t, catalog.Catalog{
+		Version: 1,
+		Tracks: []catalog.Track{{
+			Name:      "0",
+			Packaging: "loc",
+			IsLive:    true,
+			Codec:     "avc3.640028",
+		}},
+	}, cat)
+
+	trackBidi, err := sx.OpenStreamSync(ctx)
+	require.NoError(t, err)
+	_, err = trackBidi.Write(controlmessage.Subscribe{
+		RequestID: 2,
+		TrackName: "0",
+	}.Marshal())
+	require.NoError(t, err)
+
+	trackOkMsg, err := controlmessage.Read(trackBidi)
+	require.NoError(t, err)
+	trackOk, ok := trackOkMsg.(*controlmessage.SubscribeOk)
+	require.True(t, ok)
+	require.Equal(t, uint64(2), trackOk.TrackAlias)
+
+	go func() {
+		time.Sleep(200 * time.Millisecond)
+		subStream.WriteUnit(desc.Medias[0], desc.Medias[0].Formats[0], &unit.Unit{
+			PTS:     0,
+			Payload: unit.PayloadH264{{5, 1}},
+		})
+	}()
+
+	frameStream, err := sx.AcceptUniStream(ctx)
+	require.NoError(t, err)
+	var frameSG subgroup.SubGroup
+	err = frameSG.Read(frameStream)
+	require.NoError(t, err)
+
+	sps, pps := test.FormatH264.SafeParams()
+	expectedPayload, err2 := mch264.AVCC([][]byte{sps, pps, {5, 1}}).Marshal()
+	require.NoError(t, err2)
+	require.Equal(t, expectedPayload, frameSG.Objects[0].Payload)
+}
diff --git a/internal/servers/moq/session.go b/internal/servers/moq/session.go
new file mode 100644
index 00000000..d54aea18
--- /dev/null
+++ b/internal/servers/moq/session.go
@@ -0,0 +1,744 @@
+package moq
+
+import (
+	"bufio"
+	"context"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/bluenviron/gortsplib/v5/pkg/description"
+	"github.com/bluenviron/mediamtx/internal/auth"
+	"github.com/bluenviron/mediamtx/internal/defs"
+	"github.com/bluenviron/mediamtx/internal/logger"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/catalog"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/controlmessage"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/parameter"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/property"
+	"github.com/bluenviron/mediamtx/internal/protocols/moq/subgroup"
+	"github.com/bluenviron/mediamtx/internal/stream"
+	"github.com/bluenviron/mediamtx/internal/unit"
+	"github.com/google/uuid"
+	"github.com/quic-go/webtransport-go"
+	"golang.org/x/sync/errgroup"
+)
+
+const maxReorderedSubGroups = 50
+
+func findAuthorizationToken(parameters []parameter.Parameter) *parameter.AuthorizationToken {
+	for _, pa := range parameters {
+		if auth, ok := pa.(*parameter.AuthorizationToken); ok {
+			return auth
+		}
+	}
+	return nil
+}
+
+func credentialsFromAuthorizationToken(authorization *parameter.AuthorizationToken) *auth.Credentials {
+	if authorization != nil {
+		if s, ok := strings.CutPrefix(string(authorization.TokenValue), "Basic "); ok {
+			decoded, err := base64.StdEncoding.DecodeString(s)
+			if err != nil {
+				return &auth.Credentials{}
+			}
+			var user, pass string
+			user, pass, ok = strings.Cut(string(decoded), ":")
+			if !ok {
+				return &auth.Credentials{}
+			}
+			return &auth.Credentials{
+				User: user,
+				Pass: pass,
+			}
+		}
+
+		if s, ok := strings.CutPrefix(string(authorization.TokenValue), "Bearer "); ok {
+			return &auth.Credentials{
+				Token: s,
+			}
+		}
+	}
+
+	return &auth.Credentials{}
+}
+
+func tracksToCatalog(tracks []*moq.Track) (catalog.Catalog, error) {
+	cat := catalog.Catalog{
+		Version: 1,
+		Tracks:  make([]catalog.Track, len(tracks)),
+	}
+
+	for i, track := range tracks {
+		ct := catalog.Track{
+			Name:       strconv.Itoa(i),
+			Packaging:  "loc",
+			IsLive:     true,
+			Codec:      track.Codec,
+			Samplerate: track.Samplerate,
+			Channels:   track.Channels,
+			InitData:   track.InitData,
+		}
+		cat.Tracks[i] = ct
+	}
+
+	return cat, nil
+}
+
+func isSubGroupStream(b byte) bool {
+	return (b & 0x90) == 0x10
+}
+
+type sessionParent interface {
+	closeSession(sx *session)
+	logger.Writer
+}
+type session struct {
+	wt          *webtransport.Session
+	wg          *sync.WaitGroup
+	pathName    string
+	query       string
+	userAgent   string
+	pathManager serverPathManager
+	parent      sessionParent
+
+	ctx                context.Context
+	ctxCancel          context.CancelFunc
+	created            time.Time
+	uuid               uuid.UUID
+	mutex              sync.Mutex
+	state              defs.APIMoQSessionState
+	path               defs.Path
+	stream             *stream.Stream           // read only
+	tracks             []*moq.Track             // read only
+	trackSubscriptions map[int]struct{}         // read only
+	catalogReceived    chan []byte              // publish only
+	publishReady       chan struct{}            // publish only
+	inboundTracks      map[uint64]*inboundTrack // publish only
+
+	inboundBytes  atomic.Uint64
+	outboundBytes atomic.Uint64
+
+	setupReceived chan struct{}
+	done          chan struct{}
+}
+
+func (s *session) initialize() {
+	s.ctx, s.ctxCancel = context.WithCancel(context.Background())
+	s.created = time.Now()
+	s.uuid = uuid.New()
+	s.state = defs.APIMoQSessionStateIdle
+	s.trackSubscriptions = make(map[int]struct{})
+
+	s.catalogReceived = make(chan []byte, 1)
+	s.publishReady = make(chan struct{})
+
+	s.setupReceived = make(chan struct{})
+	s.done = make(chan struct{})
+
+	s.Log(logger.Info, "created by %s", s.wt.RemoteAddr())
+
+	s.wg.Add(1)
+	go s.run()
+}
+
+// Log implements logger.Writer.
+func (s *session) Log(level logger.Level, format string, args ...any) {
+	id := hex.EncodeToString(s.uuid[:4])
+	s.parent.Log(level, "[session %v] "+format, append([]any{id}, args...)...)
+}
+
+// Close implements defs.Reader.
+func (s *session) Close() {
+	s.ctxCancel()
+}
+
+func (s *session) run() {
+	defer s.wg.Done()
+	defer close(s.done)
+
+	err := s.runInner()
+
+	switch s.state {
+	case defs.APIMoQSessionStatePublish:
+		if s.path != nil {
+			s.path.RemovePublisher(defs.PathRemovePublisherReq{Author: s})
+		}
+
+	case defs.APIMoQSessionStateRead:
+		if s.path != nil {
+			s.path.RemoveReader(defs.PathRemoveReaderReq{Author: s})
+		}
+	}
+
+	s.parent.closeSession(s)
+
+	s.Log(logger.Info, "closed: %v", err)
+}
+
+func (s *session) runInner() error {
+	errGroup, errGroupCtx := errgroup.WithContext(context.Background())
+
+	errGroup.Go(func() error {
+		return s.runUniStreamAcceptor(errGroup)
+	})
+
+	errGroup.Go(func() error {
+		return s.runBidiStreamAcceptor(errGroup)
+	})
+
+	errGroup.Go(func() error {
+		return s.runSetupWriter()
+	})
+
+	select {
+	case <-s.ctx.Done():
+		s.wt.CloseWithError(0, "") //nolint:errcheck
+		errGroup.Wait()            //nolint:errcheck
+		return fmt.Errorf("terminated")
+
+	case <-errGroupCtx.Done():
+		s.ctxCancel()
+		s.wt.CloseWithError(0, "") //nolint:errcheck
+		return errGroup.Wait()
+	}
+}
+
+func (s *session) runSetupWriter() error {
+	wstream, err := s.wt.OpenUniStreamSync(context.Background())
+	if err != nil {
+		return err
+	}
+
+	_, err = wstream.Write(controlmessage.Setup{}.Marshal())
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (s *session) runUniStreamAcceptor(errGroup *errgroup.Group) error {
+	for {
+		stream, err := s.wt.AcceptUniStream(context.Background())
+		if err != nil {
+			return fmt.Errorf("AcceptUniStream returned: %w", err)
+		}
+
+		errGroup.Go(func() error {
+			return s.runUniStream(stream)
+		})
+	}
+}
+
+func (s *session) runBidiStreamAcceptor(errGroup *errgroup.Group) error {
+	for {
+		stream, err := s.wt.AcceptStream(context.Background())
+		if err != nil {
+			return fmt.Errorf("AcceptStream returned: %w", err)
+		}
+
+		errGroup.Go(func() error {
+			return s.runBidiStream(stream)
+		})
+	}
+}
+
+func (s *session) runUniStream(wstream *webtransport.ReceiveStream) error {
+	br := bufio.NewReader(wstream)
+	firstByte, err := br.Peek(1)
+	if err != nil {
+		return err
+	}
+
+	if isSubGroupStream(firstByte[0]) {
+		return s.onUniSubGroup(br)
+	}
+
+	return s.onUniMessage(br)
+}
+
+func (s *session) onUniMessage(r io.Reader) error {
+	msg, err := controlmessage.Read(r)
+	if err != nil {
+		return err
+	}
+
+	switch msg.(type) {
+	case *controlmessage.Setup:
+		err = func() error {
+			s.mutex.Lock()
+			defer s.mutex.Unlock()
+
+			select {
+			case <-s.setupReceived:
+				return fmt.Errorf("SETUP stream is already present")
+			default:
+				close(s.setupReceived)
+				return nil
+			}
+		}()
+		if err != nil {
+			return err
+		}
+
+		io.Copy(io.Discard, r)
+		return fmt.Errorf("SETUP stream closed")
+
+	default:
+		return fmt.Errorf("unsupported stream type: %T", msg)
+	}
+}
+
+func (s *session) runBidiStream(wstream *webtransport.Stream) error {
+	select {
+	case <-s.setupReceived:
+	case <-s.ctx.Done():
+		return fmt.Errorf("terminated")
+	}
+
+	msg, err := controlmessage.Read(wstream)
+	if err != nil {
+		return err
+	}
+
+	switch m := msg.(type) {
+	case *controlmessage.Subscribe:
+		s.Log(logger.Debug, "SUBSCRIBE track=%s", m.TrackName)
+
+		if m.TrackName == ".catalog" {
+			return s.onSubscribeCatalog(wstream, m)
+		}
+
+		return s.onSubscribeTrack(wstream, m)
+
+	case *controlmessage.Publish:
+		s.Log(logger.Debug, "PUBLISH track=%s alias=%d", m.TrackName, m.TrackAlias)
+
+		if m.TrackName == ".catalog" {
+			return s.onPublishCatalog(wstream, m)
+		}
+
+		return s.onPublishTrack(wstream)
+
+	default:
+		return fmt.Errorf("unsupported message type: %T", msg)
+	}
+}
+
+func (s *session) onSubscribeCatalog(wstream *webtransport.Stream, m *controlmessage.Subscribe) error {
+	s.mutex.Lock()
+	if s.state != defs.APIMoQSessionStateIdle {
+		s.mutex.Unlock()
+		return fmt.Errorf("unexpected SUBSCRIBE in state %s", s.state)
+	}
+	s.state = defs.APIMoQSessionStateRead
+	s.mutex.Unlock()
+
+	remoteHost, _, _ := net.SplitHostPort(s.wt.RemoteAddr().String())
+	addRes, err := s.pathManager.AddReader(defs.PathAddReaderReq{
+		Author: s,
+		AccessRequest: defs.PathAccessRequest{
+			Name:        s.pathName,
+			Query:       s.query,
+			Proto:       auth.ProtocolMoQ,
+			ID:          &s.uuid,
+			Credentials: credentialsFromAuthorizationToken(findAuthorizationToken(m.Parameters)),
+			IP:          net.ParseIP(remoteHost),
+			UserAgent:   s.userAgent,
+		},
+	})
+	if err != nil {
+		if _, ok := errors.AsType[*auth.Error](err); ok {
+			// wait some seconds to delay brute force attacks
+			<-time.After(auth.PauseAfterError)
+		}
+
+		var code controlmessage.RequestErrorCode
+		if _, ok := errors.AsType[*auth.Error](err); ok {
+			code = controlmessage.RequestErrorCodeUnauthorized
+		} else if _, ok = errors.AsType[*defs.PathNoStreamAvailableError](err); ok {
+			code = controlmessage.RequestErrorCodeDoesNotExist
+		} else {
+			code = controlmessage.RequestErrorCodeNotSupported
+		}
+
+		wstream.Write(controlmessage.RequestError{ //nolint:errcheck
+			Code:   code,
+			Reason: err.Error(),
+		}.Marshal())
+
+		// wait for the client to read the error
+		io.Copy(io.Discard, wstream)
+
+		return err
+	}
+
+	tracks, err := moq.FromStream(
+		addRes.Stream.Desc,
+	)
+	if err != nil {
+		addRes.Path.RemoveReader(defs.PathRemoveReaderReq{Author: s})
+		return err
+	}
+
+	s.mutex.Lock()
+	s.path = addRes.Path
+	s.stream = addRes.Stream
+	s.tracks = tracks
+	s.mutex.Unlock()
+
+	s.Log(logger.Info, "is reading from path %s", s.pathName)
+
+	_, err = wstream.Write(controlmessage.SubscribeOk{TrackAlias: m.RequestID}.Marshal())
+	if err != nil {
+		return err
+	}
+
+	cat, err := tracksToCatalog(tracks)
+	if err != nil {
+		return err
+	}
+
+	enc, err := json.Marshal(cat)
+	if err != nil {
+		return err
+	}
+
+	dataWStream, err := s.wt.OpenUniStreamSync(context.Background())
+	if err != nil {
+		return err
+	}
+	defer dataWStream.Close() //nolint:errcheck
+
+	sg := &subgroup.SubGroup{
+		Header: subgroup.Header{
+			Properties:  false,
+			FirstObject: true,
+			TrackAlias:  m.RequestID,
+			GroupID:     0,
+		},
+		Objects: []subgroup.Object{{
+			Payload: enc,
+		}},
+	}
+	buf := sg.Marshal()
+
+	_, err = dataWStream.Write(buf)
+	if err != nil {
+		return err
+	}
+
+	io.Copy(io.Discard, wstream)
+	return fmt.Errorf("SUBSCRIBE catalog stream closed")
+}
+
+func (s *session) onSubscribeTrack(wstream *webtransport.Stream, m *controlmessage.Subscribe) error {
+	trackID, err := strconv.Atoi(m.TrackName)
+	if err != nil || trackID < 0 {
+		return fmt.Errorf("invalid track name: %s", m.TrackName)
+	}
+
+	err = func() error {
+		s.mutex.Lock()
+		defer s.mutex.Unlock()
+
+		if s.state != defs.APIMoQSessionStateRead {
+			return fmt.Errorf("unexpected SUBSCRIBE in state %s", s.state)
+		}
+
+		if s.stream == nil {
+			return fmt.Errorf("stream not ready")
+		}
+
+		if trackID >= len(s.tracks) {
+			return fmt.Errorf("track index %d out of range", trackID)
+		}
+
+		_, ok := s.trackSubscriptions[trackID]
+		if ok {
+			return fmt.Errorf("already subscribed to track %d", trackID)
+		}
+
+		s.trackSubscriptions[trackID] = struct{}{}
+
+		return nil
+	}()
+	if err != nil {
+		return err
+	}
+
+	r := &stream.Reader{Parent: s}
+
+	track := s.tracks[trackID]
+	groupID := uint64(0)
+
+	wrapped := func(payload []byte, pts int64) error {
+		wstream, err2 := s.wt.OpenUniStreamSync(context.Background())
+		if err2 != nil {
+			return err2
+		}
+		defer wstream.Close() //nolint:errcheck
+
+		sg := &subgroup.SubGroup{
+			Header: subgroup.Header{
+				Properties:  true,
+				FirstObject: true,
+				TrackAlias:  m.RequestID,
+				GroupID:     groupID,
+			},
+			Objects: []subgroup.Object{{
+				Properties: property.Properties{
+					new(property.Timestamp(pts)),
+				},
+				Payload: payload,
+			}},
+		}
+		buf := sg.Marshal()
+		groupID++
+
+		_, err2 = wstream.Write(buf)
+		if err2 == nil {
+			s.outboundBytes.Add(uint64(len(payload)))
+		}
+		return err2
+	}
+
+	r.OnData(track.Media, track.Format, func(u *unit.Unit) error {
+		return track.OnData(u, wrapped)
+	})
+
+	s.stream.AddReader(r)
+	defer s.stream.RemoveReader(r)
+
+	_, err = wstream.Write(controlmessage.SubscribeOk{TrackAlias: m.RequestID}.Marshal())
+	if err != nil {
+		return err
+	}
+
+	streamClosed := make(chan struct{})
+	go func() {
+		io.Copy(io.Discard, wstream)
+		close(streamClosed)
+	}()
+
+	select {
+	case err = <-r.Error():
+		return err
+	case <-streamClosed:
+		return fmt.Errorf("SUBSCRIBE track stream closed")
+	case <-s.ctx.Done():
+		return fmt.Errorf("terminated")
+	}
+}
+
+func (s *session) onPublishCatalog(wstream *webtransport.Stream, m *controlmessage.Publish) error {
+	s.mutex.Lock()
+	if s.state != defs.APIMoQSessionStateIdle {
+		s.mutex.Unlock()
+		return fmt.Errorf("unexpected PUBLISH in state %s", s.state)
+	}
+	s.state = defs.APIMoQSessionStatePublish
+	s.mutex.Unlock()
+
+	select {
+	case catalogData := <-s.catalogReceived:
+		var cat catalog.Catalog
+		err := json.Unmarshal(catalogData, &cat)
+		if err != nil {
+			return fmt.Errorf("failed to parse catalog JSON: %w", err)
+		}
+
+		var subStream *stream.SubStream
+
+		medias, writeFuncs, err := moq.ToStream(&cat, &subStream)
+		if err != nil {
+			return err
+		}
+
+		s.inboundTracks = make(map[uint64]*inboundTrack)
+
+		for i := range cat.Tracks {
+			trackAlias := uint64(i + 1)
+			tr := &inboundTrack{
+				onSubGroup: writeFuncs[trackAlias],
+				parent:     s,
+			}
+			tr.initialize()
+			s.inboundTracks[trackAlias] = tr
+		}
+
+		remoteHost, _, _ := net.SplitHostPort(s.wt.RemoteAddr().String())
+		addRes, err := s.pathManager.AddPublisher(defs.PathAddPublisherReq{
+			Author:        s,
+			Desc:          &description.Session{Medias: medias},
+			UseRTPPackets: false,
+			ReplaceNTP:    true,
+			AccessRequest: defs.PathAccessRequest{
+				Name:        s.pathName,
+				Query:       s.query,
+				Publish:     true,
+				Proto:       auth.ProtocolMoQ,
+				ID:          &s.uuid,
+				Credentials: credentialsFromAuthorizationToken(findAuthorizationToken(m.Parameters)),
+				IP:          net.ParseIP(remoteHost),
+				UserAgent:   s.userAgent,
+			},
+		})
+		if err != nil {
+			if _, ok := errors.AsType[*auth.Error](err); ok {
+				// wait some seconds to delay brute force attacks
+				<-time.After(auth.PauseAfterError)
+			}
+
+			var code controlmessage.RequestErrorCode
+			if _, ok := errors.AsType[*auth.Error](err); ok {
+				code = controlmessage.RequestErrorCodeUnauthorized
+			} else {
+				code = controlmessage.RequestErrorCodeUninterested
+			}
+
+			wstream.Write(controlmessage.RequestError{ //nolint:errcheck
+				Code:   code,
+				Reason: err.Error(),
+			}.Marshal()) //nolint:errcheck
+
+			// wait for the client to read the error
+			io.Copy(io.Discard, wstream)
+
+			return err
+		}
+
+		s.mutex.Lock()
+		s.path = addRes.Path
+		s.mutex.Unlock()
+
+		subStream = addRes.SubStream
+
+		close(s.publishReady)
+
+	case <-s.publishReady:
+		return fmt.Errorf("catalog already received")
+
+	case <-s.ctx.Done():
+		return fmt.Errorf("terminated")
+	}
+
+	_, err := wstream.Write(controlmessage.RequestOk{}.Marshal())
+	if err != nil {
+		return err
+	}
+
+	io.Copy(io.Discard, wstream)
+	return fmt.Errorf("PUBLISH catalog stream closed")
+}
+
+func (s *session) onPublishTrack(wstream *webtransport.Stream) error {
+	s.mutex.Lock()
+	if s.state != defs.APIMoQSessionStatePublish {
+		s.mutex.Unlock()
+		return fmt.Errorf("unexpected PUBLISH in state %s", s.state)
+	}
+	s.mutex.Unlock()
+
+	_, err := wstream.Write(controlmessage.RequestOk{}.Marshal())
+	if err != nil {
+		return err
+	}
+
+	io.Copy(io.Discard, wstream)
+	return fmt.Errorf("PUBLISH track stream closed")
+}
+
+func (s *session) onUniSubGroup(r io.Reader) error {
+	var sg subgroup.SubGroup
+	err := sg.Read(r)
+	if err != nil {
+		return err
+	}
+
+	if sg.Header.TrackAlias == 0 {
+		return s.onDataCatalog(r, &sg)
+	}
+
+	return s.onDataTrack(r, &sg)
+}
+
+func (s *session) onDataCatalog(r io.Reader, sg *subgroup.SubGroup) error {
+	select {
+	case s.catalogReceived <- sg.Objects[0].Payload:
+	default:
+		return fmt.Errorf("catalog already received")
+	}
+
+	io.Copy(io.Discard, r)
+	return nil
+}
+
+func (s *session) onDataTrack(r io.Reader, sg *subgroup.SubGroup) error {
+	select {
+	case <-s.publishReady:
+	case <-s.ctx.Done():
+		return fmt.Errorf("terminated")
+	}
+
+	track, ok := s.inboundTracks[sg.Header.TrackAlias]
+	if !ok {
+		return fmt.Errorf("track %d not found", sg.Header.TrackAlias)
+	}
+
+	for _, obj := range sg.Objects {
+		s.inboundBytes.Add(uint64(len(obj.Payload)))
+	}
+
+	err := track.push(sg)
+	if err != nil {
+		return err
+	}
+
+	io.Copy(io.Discard, r)
+	return nil
+}
+
+func (s *session) apiItem() defs.APIMoQSession {
+	s.mutex.Lock()
+	state := s.state
+	s.mutex.Unlock()
+
+	return defs.APIMoQSession{
+		ID:            s.uuid,
+		Created:       s.created,
+		RemoteAddr:    s.wt.RemoteAddr().String(),
+		State:         state,
+		Path:          s.pathName,
+		Query:         s.query,
+		UserAgent:     s.userAgent,
+		InboundBytes:  s.inboundBytes.Load(),
+		OutboundBytes: s.outboundBytes.Load(),
+	}
+}
+
+// APIReaderDescribe implements defs.Reader.
+func (s *session) APIReaderDescribe() *defs.APIPathReader {
+	return &defs.APIPathReader{
+		Type: defs.APIPathReaderTypeMoQSession,
+		ID:   s.uuid.String(),
+	}
+}
+
+// APISourceDescribe implements defs.Source.
+func (s *session) APISourceDescribe() *defs.APIPathSource {
+	return &defs.APIPathSource{
+		Type: defs.APIPathSourceTypeMoQSession,
+		ID:   s.uuid.String(),
+	}
+}
diff --git a/internal/servers/rtmp/server.go b/internal/servers/rtmp/server.go
index 9c0476a3..791ab13f 100644
--- a/internal/servers/rtmp/server.go
+++ b/internal/servers/rtmp/server.go
@@ -164,7 +164,7 @@ func (s *Server) Initialize() error {
 	s.chAPIConnsGet = make(chan serverAPIConnsGetReq)
 	s.chAPIConnsKick = make(chan serverAPIConnsKickReq)
 
-	str := "listener opened on " + s.Address
+	str := "started with listener on " + s.Address
 	if s.Encryption {
 		str += " (TCP/RTMPS)"
 	} else {
@@ -206,7 +206,7 @@ func (s *Server) Log(level logger.Level, format string, args ...any) {
 
 // Close closes the server.
 func (s *Server) Close() {
-	s.Log(logger.Info, "listener is closing")
+	s.Log(logger.Info, "closing")
 
 	if !interfaceIsEmpty((s.Metrics)) {
 		if s.Encryption {
diff --git a/internal/servers/rtsp/server.go b/internal/servers/rtsp/server.go
index e46ddf30..efb07b2e 100644
--- a/internal/servers/rtsp/server.go
+++ b/internal/servers/rtsp/server.go
@@ -192,7 +192,7 @@ func (s *Server) Initialize() error {
 		return err
 	}
 
-	s.Log(logger.Info, "listener opened on %s", printAddresses(s.srv))
+	s.Log(logger.Info, "started with listeners on %s", printAddresses(s.srv))
 
 	s.wg.Add(1)
 	go s.run()
@@ -221,7 +221,7 @@ func (s *Server) Log(level logger.Level, format string, args ...any) {
 
 // Close closes the server.
 func (s *Server) Close() {
-	s.Log(logger.Info, "listener is closing")
+	s.Log(logger.Info, "closing")
 
 	if !interfaceIsEmpty(s.Metrics) {
 		if s.Encryption {
diff --git a/internal/servers/srt/server.go b/internal/servers/srt/server.go
index b761e9b3..8664a084 100644
--- a/internal/servers/srt/server.go
+++ b/internal/servers/srt/server.go
@@ -125,7 +125,7 @@ func (s *Server) Initialize() error {
 	s.chAPIConnsGet = make(chan serverAPIConnsGetReq)
 	s.chAPIConnsKick = make(chan serverAPIConnsKickReq)
 
-	s.Log(logger.Info, "listener opened on "+s.Address+" (UDP)")
+	s.Log(logger.Info, "started with listener on "+s.Address+" (UDP/SRT)")
 
 	l := &listener{
 		ln:     s.ln,
@@ -151,7 +151,7 @@ func (s *Server) Log(level logger.Level, format string, args ...any) {
 
 // Close closes the server.
 func (s *Server) Close() {
-	s.Log(logger.Info, "listener is closing")
+	s.Log(logger.Info, "closing")
 
 	if !interfaceIsEmpty(s.Metrics) {
 		s.Metrics.SetSRTServer(nil)
diff --git a/mediamtx.yml b/mediamtx.yml
index 951062cd..79a7bb37 100644
--- a/mediamtx.yml
+++ b/mediamtx.yml
@@ -146,11 +146,11 @@ authJWTAudience:
 ###############################################
 # Global settings -> Control API
 
-# Allow clients to control the server through the Control API.
+# Enable the control API server, which allows to control the server.
 api: false
-# Address of the Control API listener.
+# Address of the TCP/HTTP listener.
 apiAddress: :9997
-# Enable HTTPS on the Control API server.
+# Enable HTTPS.
 apiEncryption: false
 # Path to the server key. This is needed only when encryption is yes.
 # This can be generated with:
@@ -168,13 +168,13 @@ apiAllowOrigins: ["*"]
 apiTrustedProxies: []
 
 ###############################################
-# Global settings -> Metrics
+# Global settings -> Metrics server
 
-# Allow clients to extract Prometheus-compatible metrics.
+# Enable the metrics server, which allows to extract Prometheus-compatible metrics.
 metrics: false
-# Address of the metrics HTTP listener.
+# Address of the TCP/HTTP listener.
 metricsAddress: :9998
-# Enable HTTPS on the Metrics server.
+# Enable HTTPS.
 metricsEncryption: false
 # Path to the server key. This is needed only when encryption is yes.
 # This can be generated with:
@@ -192,13 +192,13 @@ metricsAllowOrigins: ["*"]
 metricsTrustedProxies: []
 
 ###############################################
-# Global settings -> PPROF
+# Global settings -> PPROF server
 
-# Allow clients to extract pprof-compatible performance reports.
+# Enable the PPROF server, which allows to extract performance reports.
 pprof: false
-# Address of the pprof listener.
+# Address of the TCP/HTTP listener.
 pprofAddress: :9999
-# Enable HTTPS on the pprof server.
+# Enable HTTPS.
 pprofEncryption: false
 # Path to the server key. This is needed only when encryption is yes.
 # This can be generated with:
@@ -218,11 +218,11 @@ pprofTrustedProxies: []
 ###############################################
 # Global settings -> Playback server
 
-# Allow clients to download recordings from the playback server.
+# Enable the playback server, which allows to download recordings from the server.
 playback: false
-# Address of the playback server listener.
+# Address of the TCP/HTTP listener.
 playbackAddress: :9996
-# Enable HTTPS on the playback server.
+# Enable HTTPS.
 playbackEncryption: false
 # Path to the server key. This is needed only when encryption is yes.
 # This can be generated with:
@@ -242,7 +242,7 @@ playbackTrustedProxies: []
 ###############################################
 # Global settings -> RTSP server
 
-# Allow clients to publish and read streams with the RTSP protocol.
+# Enable the RTSP server, which allows to publish and read streams with the RTSP protocol.
 rtsp: true
 # Enabled RTSP transport protocols. The handshake is always performed with TCP.
 rtspTransports: [udp, multicast, tcp]
@@ -285,14 +285,14 @@ rtspAuthMethods: [basic]
 ###############################################
 # Global settings -> RTMP server
 
-# Allow clients to publish and read streams with the RTMP protocol.
+# Enable the RTMP server, which allows to publish and read streams with the RTMP protocol.
 rtmp: true
 # Use the secure protocol variant (RTMPS).
 # Available values are "no", "strict", "optional".
 rtmpEncryption: "no"
-# Address of the RTMP listener. This is needed only when encryption is "no" or "optional".
+# Address of the TCP/RTMP listener. This is needed only when encryption is "no" or "optional".
 rtmpAddress: :1935
-# Address of the RTMPS listener. This is needed only when encryption is "strict" or "optional".
+# Address of the TCP/RTMPS listener. This is needed only when encryption is "strict" or "optional".
 rtmpsAddress: :1936
 # Path to the server key. This is needed only when encryption is "strict" or "optional".
 # This can be generated with:
@@ -305,11 +305,11 @@ rtmpServerCert: server.crt
 ###############################################
 # Global settings -> HLS server
 
-# Allow clients to read streams with the HLS protocol.
+# Enable the HLS server, which allows to read streams with the HLS protocol.
 hls: true
-# Address of the HLS listener.
+# Address of the TCP/HTTP listener.
 hlsAddress: :8888
-# Enable HTTPS on the HLS server.
+# Enable HTTPS.
 # This is required for Low-Latency HLS to function correctly on Apple devices.
 hlsEncryption: false
 # Path to the server key. This is needed only when encryption is yes.
@@ -368,13 +368,13 @@ hlsCDNSecret: ""
 ###############################################
 # Global settings -> WebRTC server
 
-# Allow clients to publish and read streams with the WebRTC protocol.
+# Enable the WebRTC server, which allows to publish and read streams with the WebRTC protocol.
 webrtc: true
-# Address of the WebRTC HTTP listener.
+# Address of the WebRTC TCP/HTTP listener.
 webrtcAddress: :8889
-# Enable HTTPS on the WebRTC server.
-# This covers only the WebRTC handshake and does not influence the encryption of WebRTC streams
-# which are always encrypted, with a key that is exchanged during the WebRTC handshake.
+# Enable HTTPS.
+# This covers only the WebRTC handshake, while WebRTC streams
+# are always encrypted with a key that is exchanged during the WebRTC handshake.
 webrtcEncryption: false
 # Path to the server key.
 # This can be generated with:
@@ -390,10 +390,10 @@ webrtcAllowOrigins: ["*"]
 # If the server receives a request from one of these entries, IP in logs
 # will be taken from the X-Forwarded-For header.
 webrtcTrustedProxies: []
-# Address of a local UDP listener that will receive connections.
+# Address of a UDP/ICE listener that will receive connections.
 # Use a blank string to disable.
 webrtcLocalUDPAddress: :8189
-# Address of a local TCP listener that will receive connections.
+# Address of a TCP/ICE listener that will receive connections.
 # This is disabled by default since TCP is less efficient than UDP and
 # introduces a progressive delay when network is congested.
 webrtcLocalTCPAddress: ""
@@ -425,11 +425,35 @@ webrtcTrackGatherTimeout: 2s
 ###############################################
 # Global settings -> SRT server
 
-# Allow clients to publish and read streams with the SRT protocol.
+# Enable the SRT server, which allows to publish and read streams with the SRT protocol.
 srt: true
-# Address of the SRT listener.
+# Address of the UDP/SRT listener.
 srtAddress: :8890
 
+###############################################
+# MoQ server
+
+# Enable the MoQ (Media over QUIC) server, which allows to publish and read streams with the MoQ protocol.
+moq: true
+# Address of the TCP/HTTPS2 listener.
+# This hosts the web client.
+moqHTTPS2Address: :8892
+# Address of the UDP/HTTPS3 listener.
+# This hosts the WebTransport endpoint.
+moqHTTPS3Address: :8892
+# Path to the server key.
+# This can be generated with:
+# openssl genrsa -out server.key 2048
+# openssl req -new -x509 -sha256 -key server.key -out server.crt -days 3650
+# If set to "auto.key", a key is generated automatically and saved in the current folder.
+moqServerKey: auto.key
+# Path to the server certificate.
+moqServerCert: auto.crt
+# Allowed origins for CORS.
+moqAllowOrigins: ["*"]
+# Proxies which are trusted to provide the client's real IP via the X-Forwarded-For header.
+moqTrustedProxies: []
+
 ###############################################
 # Default path settings