Skip to main content
CapOut uses two auth models:

​
API key header

Send your organization-scoped API key in the capout-api-key header on REST calls.

​
Realtime tokens

Realtime connections do not use the API key directly. Instead:
  1. Call POST /ws/token with your API key.
  2. Read token, ws_url, sse_url, and expires_at.
  3. Connect with ?token=<token> in the query string.
This separation matters for browser clients, especially for SSE, where setting custom headers is not supported by EventSource.

​
Token-based stream URLs

Specific documents:
Recent organization documents:

​
Expiration strategy

Treat realtime tokens as short-lived connection credentials:
  • Mint them just before opening a stream.
  • Re-mint on reconnect if the token has expired.
  • Keep API keys on trusted backend infrastructure when possible.