Security
Authentication
Deep dive into browser session handshakes, JWT token lifetimes, and Origin header verification.
Overview
Client authentication uses an ephemeral token exchange protocol that protects backend resources without requiring end-users to log in.
Handshake & JWT Token Lifecycle
- The SDK dispatches
POST /api/v1/sdk/handshakewithprojectIdandpublicKey.
- The Edge Gateway verifies that
req.headers['origin']matches the Allowed Domains list.
- The server issues an ephemeral JSON Web Token (JWT) signed with Ed25519 with a 24-hour expiration.
- The client uses this JWT as a bearer token for subsequent WebSocket and SSE streams.
Tamper-Proof Signatures
If a client attempts to modify the payload claims or extend the expiration timestamp, the signature verification fails and the connection is dropped immediately.