Realtime auth

The endpoints the browser SDK calls to obtain connection and subscription tokens.

Endpoints

These endpoints live under /api/platform/emitwave/* and require an end-user Bearer token. The browser SDK calls them automatically; you rarely call them directly.

Connect token

connect() POSTs the public application key here with the end-user Bearer token. This is required for every connection, including connections that subscribe only to public channels. The response returns a short-lived connection token and the application ID used to scope channel names.

Channel authorization

Private, private-cache, presence, presence-cache, and private-encrypted channels call this before subscribing. EmitWave evaluates the registered channel callback for the authenticated user. Private callbacks return a truthy value; presence callbacks return { id, info }; encrypted channels additionally receive a per-channel decryption key in the response. See Authentication.

Debug subscription

Platform tools can request an exact internal channel plus a channel-bound subscription token to inspect an application's live publish traffic. Pair both values and pass them to the SDK's subscribeWithToken(); the short-lived token only authorizes the exact returned channel. Access follows the application's view permission.