Get Realtime Token
Mint a short-lived Centrifugo connection token. The token carries the session facts the org boundary needs (``meta``), so org-scoped channels are authorized like org-scoped REST routes rather than by membership alone. It names no org and grants no org channel by itself: org-scoped subscriptions need a token from ``POST /v1/realtime/subscription-tokens``.
Authorization
BearerAuth Botyard API key — see /docs/authentication.
In: header
Response Body
application/json
curl -X GET "https://example.com/v1/realtime/token"{
"token": "string"
}{
"type": "string",
"title": "string",
"status": 0,
"detail": "string",
"instance": "string",
"error_code": "string",
"errors": [
{
"pointer": "string",
"detail": "string",
"type": "string"
}
],
"trace_id": "string"
}Realtime
Botyard REST API endpoints for realtime.
Mint Subscription Tokens
Mint short-lived subscription tokens for org-scoped realtime channels. Each channel is authorized exactly like the Centrifugo subscribe proxy authorizes it, from this request's own verified session: the org boundary (membership, ``mfa_required``, IdP reach and SSO revocation, require-SSO) plus the channel's own scope (a private conversation's owner, a bot's visibility). The boundary is evaluated once per org in the batch. A granted token expires (``exp``) and Centrifugo enforces that locally, so a subscription made with it ends unless the client keeps presenting newer tokens. This route refuses them once one of the facts above refuses the session, even when Centrifugo cannot reach the API (PlatDev #4534). Exception: a signed-out or revoked FIRST_PARTY session. Its bearer JWT is honoured until it expires, here as on every REST route, so it keeps minting until then. Every ``exp`` counts from before the first fact is read. A batch that outlasts the whole lifetime gets no tokens; it is answered with a retryable 503 instead. Per-channel results, never all-or-nothing: one refused channel does not cost the client the rest. Duplicates are answered once, at their first position. ``personal:`` channels are refused as ``invalid_channel``; they are authorized by the connection token alone and need no subscription token.