Authentication and credentials
Select the correct credential for dashboard, trusted-server, app-user, realtime, and webhook flows.
Credential map
| Credential | Where it belongs | Purpose |
|---|---|---|
| Dashboard session cookie | V Chat dashboard in the browser | Control-plane organization/application administration |
| Application credential | Customer server or worker secret store | Trusted data-plane operations and app-user token issuance |
| App-user bearer token | Browser/mobile memory for one user session | End-user REST calls and realtime ticket issuance |
| Realtime connection ticket | In-memory, one use | Short-lived WebSocket handshake authorization |
| Webhook signing secret | Receiving server secret store | Verify raw webhook bytes before parsing |
Use a token provider
The browser or Flutter client calls your authenticated backend. Your backend derives the current user ID from its session, asks V Chat for an app-user token with the protected application credential, and returns only the opaque short-lived token.
async function fetchCurrentUserChatToken({ forceRefresh }: { forceRefresh: boolean }) {
const response = await fetch('/api/chat/token', {
method: 'POST',
credentials: 'same-origin',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ forceRefresh }),
});
if (!response.ok) throw new Error('Unable to obtain a chat token');
return response.json() as Promise<{ token: string; expiresAt?: string }>;
}Refresh and logout
- Keep bearer tokens in memory; the released clients do not persist or decode them.
- Coalesce concurrent refresh work through the SDK token provider boundary.
- A known expiry is refreshed before its configured skew window; an eligible 401 permits one forced refresh.
- On logout or account switch, disconnect realtime, revoke device registration when applicable, dispose the client, and clear scoped cached state.