> For the complete documentation index, see [llms.txt](https://docs.tryterra.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tryterra.co/reference/streaming-api/api-endpoints.md).

# Authentication

The three tokens each streaming connection needs, and the endpoints that mint them.

Every WebSocket connection to the Streaming API authenticates with a short-lived token. Your backend mints all three tokens with your dev ID and API key. Never ship those credentials in your app.

| Token            | Minted from                                | Used for                                                                                                                                                                        |
| ---------------- | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SDK (auth) token | `POST /auth/generateAuthToken` (main API)  | Initializing the RT SDK in your app. This is the token you pass to `initConnection`.                                                                                            |
| Producer token   | `POST /auth/user?id=<user_id>` (streaming) | Your app's producer connection. This is the token you pass to `startRealtime(...)` to stream the wearable's data to Terra. `<user_id>` is the streaming user's Terra `user_id`. |
| Developer token  | `POST /auth/developer` (streaming)         | Your backend's consumer connection, which receives the live stream.                                                                                                             |

The two streaming tokens (`/auth/user` and `/auth/developer`) are single-use and short-lived. Each is consumed on the first `IDENTIFY` (the WebSocket handshake), so mint a fresh one for every connection and every reconnect. The SDK token (`generateAuthToken`) is reusable for its lifetime.

If you connect to the WebSocket directly, without an SDK, the producer token pairs with `IDENTIFY` type `0` (User) and the developer token with type `1` (Developer).

## Endpoints

{% openapi src="<https://raw.githubusercontent.com/tryterra/openapi/refs/heads/master/dist/core/v2-bundled.yaml>" path="/auth/generateAuthToken" method="post" %}
<https://raw.githubusercontent.com/tryterra/openapi/refs/heads/master/dist/core/v2-bundled.yaml>
{% endopenapi %}

{% openapi src="<https://raw.githubusercontent.com/tryterra/openapi/refs/heads/master/dist/core/rt-bundled.yaml>" path="/auth/developer" method="post" %}
<https://raw.githubusercontent.com/tryterra/openapi/refs/heads/master/dist/core/rt-bundled.yaml>
{% endopenapi %}

{% openapi src="<https://raw.githubusercontent.com/tryterra/openapi/refs/heads/master/dist/core/rt-bundled.yaml>" path="/auth/user" method="post" %}
<https://raw.githubusercontent.com/tryterra/openapi/refs/heads/master/dist/core/rt-bundled.yaml>
{% endopenapi %}