Dashboard|

Browser access

Talk to an agent from the browser with short-lived client tokens.

Never put a secret key in a browser. Mint a client token on your server instead: a 15-minute ect_ token scoped to one tenant and end user.

POST /v1/client-tokens
CENCORI_API_KEY: csk_...
 
{
  "tenant_id": "ten_...",
  "external_user_id": "user_42",
  "permissions": ["sessions:create", "sessions:turn"]
}

The browser sends it as Authorization: Bearer ect_....

Permissions
PermissionAllows
sessions:createCreating sessions (default)
sessions:turnSending turns and reading its own sessions (default)
sessions:approveApproving and rejecting paused tool calls in its own sessions. Not granted unless you ask for it

A token only reaches sessions of its own tenant and user. Anything else is a 404, as if the session didn't exist.

Approvals from the browser

Grant sessions:approve when the end user is the right person to decide: "Book this flight?", "Send this email?". Keep approvals on your server when someone else should decide, like a manager approving a refund.

With Agent UI you don't need this: approvals go through your own route, which holds the secret key.

Did you like the content?