Skip to main content
CapOut uses two authenticated access models:

​
API key header

Send your organization-scoped API key in the capout-api-key header on REST calls.
GET /{document_id}.esx requires the same capout-api-key header as upload. CapOut derives the caller’s organization from that key and returns 404 when the document is unknown or belongs to another organization. Never put an API key in the URL or query string. The route does not expose a permanent S3 URL. After authorization and export completion, it returns a non-cached 307 redirect to a freshly signed private artifact. See Download ESX files.

​
Realtime tokens

Realtime connections do not use the API key directly. Instead:
  1. Call POST /ws/token with your API key.
  2. Read token, ws_url, sse_url, and expires_at.
  3. Connect with ?token=<token> in the query string.
This separation matters for browser clients, especially for SSE, where setting custom headers is not supported by EventSource.

​
Token-based stream URLs

Specific documents:
Recent organization documents:

​
Expiration strategy

Treat realtime tokens as short-lived connection credentials:
  • Mint them just before opening a stream.
  • Re-mint on reconnect if the token has expired.
  • Keep API keys on trusted backend infrastructure when possible.