Matthew Meszaros 0c40e53e02 feat: bind each realtime ws ticket to the session that minted it and accept it once while that session is live, require a second-factor session to join admin:platform, confine API key and OAuth sockets to their own workspace with member permissions narrowed to their read scopes, and refuse those credentials in the socket URL unless REALTIME_ALLOW_QUERY_CREDENTIALS=true

2026-10-23 15:48:00 +02:00

..

realtime

feat: bind each realtime ws ticket to the session that minted it and accept it once while that session is live, require a second-factor session to join admin:platform, confine API key and OAuth sockets to their own workspace with member permissions narrowed to their read scopes, and refuse those credentials in the socket URL unless REALTIME_ALLOW_QUERY_CREDENTIALS=true

2026-10-23 15:48:00 +02:00

realtime_web

feat: bind each realtime ws ticket to the session that minted it and accept it once while that session is live, require a second-factor session to join admin:platform, confine API key and OAuth sockets to their own workspace with member permissions narrowed to their read scopes, and refuse those credentials in the socket URL unless REALTIME_ALLOW_QUERY_CREDENTIALS=true

2026-10-23 15:48:00 +02:00

realtime.ex

Realtime, api keys & more

2026-01-26 16:04:42 +01:00