How do I let a browser publish or read without exposing my API key?
Never put the API key in a page. Keep it on your server, and have your server hand each browser a short-lived agent token that you limited to what that page needs. The browser calls CyberPlex with the token. When the token expires (at most an hour), the page asks your server for a new one.
How it works
Your backend exchanges its API key for a token. This is the only place the key lives:
curl -s -X POST $CYBERPLEX_URL/v1/agent-token \
-H "Authorization: Bearer $CYBERPLEX_API_KEY" -H 'Content-Type: application/json' \
-d '{"agentId":"visitor-81","ops":["history"],"channels":["room-*"],"ttlSec":300}'
# {"token":"eyJ...","expiresInSec":300}
opslimits what the token can do:publish,history(read),presence.channelslimits where: exact names or prefixes such asroom-*, up to 20 entries.ttlSecis the lifetime, from 1 second to 1 hour.agentIdis who the messages come from, and you choose it.
A sample backend that does this is examples/token-server.mjs, and a dependency-free browser page that renews its token is the browser example.
Two more rules apply to browsers:
- Origins. The browser's site must be one of the origins registered for your tenant. We register them during onboarding, and any other site is refused (
403). Server-to-server calls send noOriginheader and are not affected. - Revocation. If your API key is revoked, every token it minted stops working within about 10 seconds.
Trying it with no key at all
The public demo needs no key: POST /v1/demo/token returns a 5-minute token for the one channel demo-lobby. It is shared and public, so send nothing private.
When not to use CyberPlex
- Each viewer must see only their own private messages, enforced by the messaging layer. A token is scoped by operation and channel name, not by user identity. Your backend can mint a token limited to one channel per user, but that is your backend's job, and anyone holding a token for a channel can read it. If you need per-user access rules inside the messaging layer, this is not that.
- You cannot run any backend. The key has to stay somewhere safe, and something must mint tokens. A purely static site with no server cannot do that, other than using the public demo channel.
- A single token must be revocable on its own. Tokens cannot be revoked individually before they expire. Keep lifetimes short, or revoke the API key that minted them (which stops all of them).
- The messages are secret and the page is public. Anyone who gets a token can use everything it allows until it expires.