Security
Browser tokens
Limit browser authority to one connection and one exact origin.
Issue a browser token only after authorizing the signed-in user against your own application data.
const access = await platform.issueConnectionToken(connectionId, {
origin: 'https://app.example.com',
})- Use an origin, not a URL path, query, or fragment.
- Prefer the same-origin connection bridge from the SDK.
- Keep tokens in memory; do not place them in URLs or durable browser storage.
- Refresh near expiry through your authenticated server.
- Never upgrade a connection token into platform authority.
The bridge allowlists browser-safe routes, caps body size, and forwards no cookies or platform API keys.