API reference

Relay and backend API

HTTP and WebSocket endpoints behind live streams.

stream-watch-ticket

POST https://clahbbkqdskkhymymoge.supabase.co/functions/v1/stream-watch-ticket. Call it from your backend, with x-api-key set to the auth part of your API key (before the .).

Response	Meaning
`200`	`{ ticket, expiresIn: 120, stream }`
`400 bad_stream_id`	streamId is missing or not a UUID.
`401 missing_api_key`	No x-api-key header.
`401 invalid_api_key`	Unknown key.
`403 revoked_api_key`	The key was revoked.
`403 stream_not_watchable`	The stream does not exist, or the key’s holder may not watch it: only their own personal streams, public streams, or streams of a project they can view (a project key: only its own project).
`500 ticket_signing_unavailable`	The operator has not configured WATCH_TICKET_SECRET.

POST https://clahbbkqdskkhymymoge.supabase.co/functions/v1/stream-token with x-api-key (the auth part) returns { token, userId, expiresIn: 900, maxRateHz, relayUrl }. The token is a pt. publisher token accepted only by stream-publisher (register, heartbeat, delete, resolve_org), which returns the pp. tickets the relay accepts for publishing. See Publishing streams. A key whose project is archived gets 403 project_archived: unarchive the project or use another key.

Relay WebSocket

HTTP

GET wss://<relay>/v1/streams/<streamId>/watch      (viewers: session JWT or wt. ticket)
GET wss://<relay>/v1/streams/<streamId>/publish    (publishers: pp. ticket only)
Sec-WebSocket-Protocol: kymoscope-live.v1, bearer.<credential>

Status	Meaning
`101`	Connected.
`400`	The stream id is not a UUID.
`401`	Missing, invalid or expired credential; also any ticket on the publish route.
`403`	The credential is valid but not for this stream.
`426`	Not a WebSocket upgrade.
`429`	Too many connection attempts from this address.
close `4401`	The credential expired on an open socket. Renew it in-band before expiry with {"type":"auth","token":…}.
`502`	The relay could not reach the authorisation service.