Skip to main content

Overview

Use this flow for browser realtime subscriptions:
  1. Your backend calls POST /api/realtime/session with a secret API key.
  2. Sippet returns a short-lived session_token.
  3. Your backend returns that token to the browser.
  4. The browser connects to /socket with session_token.
Publishable keys no longer grant realtime subscriptions, REST reads, or RPC actions.

Server-side token minting

Call Sippet from your backend only.

Browser socket initialization

Refresh strategy

  • Tokens are short-lived (default 5 minutes).
  • Re-mint before expiry or on socket auth failure.
  • Keep refresh logic in your backend route, not in client code.

Migration notes

If you previously called initSocket({ publishableKey }), migrate to socketOptions.params.session_token.
  • Quickstart: /quickstart
  • Realtime patterns: /guides/realtime-telephony-patterns
  • SDK introduction: /sdk-js/introduction