Skip to main content

A credential an EventSource can carry.

POST 
/api/auth/stream-ticket

GET /api/stream is per workspace like everything else, and the browser API that opens it cannot set a header: new EventSource(url) takes a URL and nothing more. Putting the session token in the query string instead would put a thirty-minute credential into every access log and proxy cache between here and the browser.

So this mints a ticket: authenticated, naming one workspace, good for a minute and spent the moment the stream picks it up. One in a log is worth a single SSE connection, and only if the console has not already used it — which it does immediately.

Responses​

a single-use ticket for GET /api/stream