Access
Account authentication and authorization
Distinguish signed-in account sessions, access eligibility, video ownership, conversation scope and embedded viewer credentials.
Identify the acting principal
| Principal | Credentials | Scope |
|---|---|---|
| Signed-in account | Authenticated account session and user access token | Authorized application resources and owned conversations, subject to account access and capacity policy. |
| Embedded guest | Runtime-issued viewer token | The published experience and isolated visitor conversation. No owner login or account profile. |
| Identified private viewer | Short-lived signed grant, then runtime-issued viewer credentials | Authorized private experience access. Not an account browser profile or private website login. |
A resource ID, video link, session UUID or model name does not authorize access. The server verifies the principal and applicable resource boundary.
Use the account’s current credentials
- Sign in through the application’s account flow.
- Resolve the account session through its authenticated client.
- Use a fresh user access token for direct backend HTTP and socket requests.
- Handle expired or refused credentials through the account sign-in flow.
Current chat clients obtain fresh credentials from the account auth client. A copied stale cookie token is not a reliable credential source.
| Request surface | Authentication boundary |
|---|---|
| Direct backend /v1/ HTTP | Authorization: Bearer <fresh user access token>. |
| Account /ws/agent-stream | Current browser client supplies the user token in the token query parameter. Never log the resulting URL. |
| Same-origin owner /api routes | Authenticated application session cookies, with additional bearer headers where the route requires them. |
| Supabase source transfer | Authenticated account storage authorization and the owned provisional video/storage policy. |
| Embedding loader | No owner token in the copied snippet. The runtime obtains viewer credentials through its own admission flow. |
These protocols do not define an account API-key exchange, long-lived service token or customer administrator credential.
Use the application’s configured backend origin. Browser CORS and application session rules still apply; a bearer token does not authorize every third-party origin.
Separate sign-in, access approval and ownership
A valid account session establishes identity. Metered account operations also require an existing account profile and access approval for a non-exempt account.
Account cohort membership can configure limits. Cohort membership alone is not the access approval checked by usage admission.
Video ingest and owner processing reads verify video authority. A signed-in account does not automatically own another account’s source video.
Published viewing, private source access and owner editing have different rules. Do not treat a public video page as permission to edit or ingest its source.
Conversation ownership and scope are checked independently. An account cannot continue an embedded visitor’s conversation by guessing its identifier.
Use supported account and model settings
Production requests normally use deployed model and provider defaults. A model field in a request is not a guarantee of arbitrary model selection.
Generator and browser-agent override permissions differ. Development controls do not establish the same configuration surface for ordinary production accounts.
Account voice availability depends on browser permissions, authenticated service admission and configured runtime features. It does not use an embed publication’s Voice switch.
Website sign-in requires the account browser profile capability and the current task’s handoff. A RapidEye login alone does not sign into an external website.
Keep credentials outside reusable examples
- Keep access tokens, refresh tokens and private grants out of screenshots and shared logs.
- Never publish a storage service-role credential or worker authentication secret.
- Do not share credential-bearing socket URLs.
- Pass credentials as runtime values from the authorized session.
- Exclude private chat text, personal details and browser login data from diagnostic reports.
Administrative catalogue, deployment and infrastructure controls are outside this public reference. A customer integration must not depend on operator privileges.