PATTERN Cited by 1 source

Scoped token per operation

Problem

In a pub/sub system, a single shared credential for both publishers and subscribers allows credential misuse — a viewer could impersonate a broadcaster by using the same credential to publish.

Solution

Issue separate tokens per operation class (publish, subscribe, or both) on a given resource, each with its own expiration and revocability. The relay checks the token at session open and enforces what operations that token permits.

Consequences

• Role separation — publisher and subscriber roles are cryptographically distinct.
• Independent revocation — disabling one token doesn't disrupt other clients.
• Flexible granularity — can issue time-limited tokens for specific audiences (e.g., a "viewers" token expiring at midnight).
• URL-embedded — in MoQ, the token travels in the URL path, simplifying client integration.

Seen in

• sources/2026-07-31-cloudflare-an-api-for-moq-provision-your-own-isolated-relays — MoQ relay tokens with publish/subscribe separation: "Handing publishers and subscribers different tokens is what stops a viewer from taking over a broadcaster's tracks"