API reference / Share links
Share links
There is no route that mints a shareable URL for a live avatar session. No token, no expiry, no usage limit, no origin allowlist, and no embeddable player.
The reason is a trust boundary rather than a missing table. Every route on this
service requires a credential: the only exceptions are the page shell, the
health check, static assets and OPTIONS preflights. A share link
is by definition anonymous reachability, so shipping one is a new security
posture, not a new endpoint.
The thing that looks adjacent, and is not
Publishing an avatar exists and is easy to mistake for this. It is a different object with a different lifetime:
| A share link | Avatar publication | |
|---|---|---|
| What is shared | One live conversation | One face |
| Who can reach it | Anyone with the URL | Other developers signed in to this portal |
| Lifetime | Minutes to hours, with an expiry | Until it is withdrawn |
| Credential | None, by design | A portal session, always |
PUT /auth/avatars/{id}/visibility moves a face into a separate shared
partition, read back by GET /auth/avatars/public. Both are documented under
Avatars. Neither is anonymous: the public list still
requires a signed in person, and "the people who sign in here" is exactly what
the person publishing is told.
What to build instead
Put the session behind your own application. Your backend authenticates whoever
you want to let in, mints a short lived, stream only token with
POST /v1/streaming.create_token, and hands that to
the page. The token expires in minutes and can never mutate anything, so the
blast radius of a leaked one is a stream nobody wanted.
That gives you the useful half of a share link, with your own rules about who may open it, and it works today.
Not served in this group
List, create, read, update and delete a share link. All five.