From Dev.to
Scoped Realtime Tokens for Express Chat Rooms — Reconnects, Fan-out, and Retention
Short answer: verify the session on the server, issue a short-lived token limited to the browser user's channels, and renew it before expiry. The browser should never receive the server key. For an ed...