Tokens

Generate popout tokens for browser sources, dashboards, and other unattended views that need access to your account without a logged-in browser session.

What Are Popout Tokens?

Popout tokens (prefix lm_pop_) are secret strings that authenticate a single URL without your browser cookies. By default they never expire, but you can optionally set an expiry time or revoke a token at any point (see Token Management). They are designed for:

• Browser sources — drop a URL with ?token=lm_pop_… into OBS, no login UI required
• Stream-deck buttons — open a popout view directly to a control surface
• Shared dashboards — give a moderator read-only access to a single view
• Remote control overlays — receive live events on another machine

Creating a Token

Creating a token opens a full-screen wizard with three steps. Click New Token on Manage → Tokens to start:

1. Identity — optionally enter a label (only for your reference) and choose who the token belongs to. Leaving the assignment on Yourself binds the token to you; pick a member to attribute its actions to that user instead.
2. Permissions — tick the permissions the token may use (e.g. events:read, events:create, overlays:read, spotify:read, spotify:playback, chat:read, chat:write, chat:ban, chat:timeout, chat:delete, chat:notes). You can only select permissions you hold yourself — ones outside your own access are shown disabled. At least one permission is required before you can continue.
3. Lifetime — choose when the token expires (see Token lifetime below). The default is Never.

Click Create token on the last step, then copy the full token immediately — the secret is shown only once on the final screen. That screen has no close (✕); press Done when you have copied the token.

A token can never grant more permissions than the user who creates or edits it. This is enforced on both the create and the edit path (identically on the GraphQL and REST APIs): if you request a permission you do not currently hold, the request is rejected. If you lose your access to a permission later, the token loses it too.

Using a Token

Append the token as a ?token= query parameter to any URL that supports popout authentication:

https://lumio.vision/popout/events?token=lm_pop_xxxxxxxxxxxx

On the first load, the raw token in the URL is exchanged once, server-side, for a short-lived popout session (a 15-minute httpOnly cookie), and the page redirects to the token-less URL. From then on the raw token no longer appears in the address bar, the WebSocket URL, or any network request — WebSocket subscriptions, REST proxy calls, and SSR data all authenticate through the session cookie. The session is refreshed transparently for as long as the token stays valid, so a browser source can stay open indefinitely.

You still only pass the token once in the URL. Saved URLs keep working: an existing OBS browser source whose stored URL contains ?token=lm_pop_… is exchanged automatically on load — no setup breaks.

Where Popout Tokens Work

Lumio currently exposes four popout pages plus the overlay route. Popouts live on the dashboard host (lumio.vision) and accept ?token= for popout-token auth. Overlays live on their own host (overlay.lumio.vision) and carry their own access token, which is not a popout token — you get the complete URL from Copy Link on the overlay card.

URL	Host	What it shows	Recommended permissions
/popout/events	lumio.vision	Live event feed (followers, subs, cheers, raids, redemptions, tips) with channel-status indicator	events:read (+ chat:userinfo for enriched profiles)
/popout/chat	lumio.vision	Unified multi-platform chat view with moderation actions	chat:read (+ chat:write to send, chat:ban/chat:timeout/chat:delete to moderate)
/popout/music	lumio.vision	Spotify "now playing" widget with playback controls	spotify:read (+ spotify:playback to control playback)
/popout/obs	lumio.vision	OBS Remote control panel (scenes, stream/recording state)	settings:read
/overlay/\{key\}	overlay.lumio.vision	Any overlay, rendered as a browser source	none — the overlay's own access token is already in the URL
/overlay/\{key\}/preview	overlay.lumio.vision	Preview of an overlay inside the dashboard	same as above

Overlays are intentionally separate: each one has its own access token, minted for the overlay rather than for a person, and revocable on its own from the overlay's menu. Loading /overlay/\{key\} without that token returns "403 — Access token required". See Overlays.

Browser Source Setup

1. Create the popout token with the permissions you need (for /popout/events you only need events:read) and copy the secret on the final screen — it is never shown again
2. Build the URL yourself: take the popout page you want and append ?token= plus the secret, e.g. https://lumio.vision/popout/events?token=lm_pop_…
3. In OBS: Add → Browser, paste the URL
4. Width/height: 400×600 for chat, 600×120 for music, 500×400 for events (rule of thumb)
5. Custom CSS (optional): body { background: transparent; } if the popout doesn't already render transparent

Token Management

Each token on the Manage → Tokens page shows an always-visible status line — Never expires, Expires on {date}, Expired on {date}, or Revoked on {date} — alongside a badge that flags a token that is Expired, Revoked, or Expiring soon (within 7 days of its expiry). Each card also shows the assigned member — or Unknown member when your role cannot resolve member names (members:read) — plus when the token was created and last used. Clicking the pencil icon opens the token in the same three-step wizard, where you can jump straight to any step:

• Edit — change label, assigned member, or permissions any time; Save is available on every step and only submits the fields you actually changed.
• Set an expiry — on the Lifetime step, pick a preset or a custom date (see Token lifetime); the token stops working automatically after that moment. Choose Never to make the token non-expiring again. An already-expired token can be pushed back into the future here — its status updates accordingly.
• Revoke — on the Lifetime step, mark the token revoked without deleting it; all popout URLs using it stop working immediately. A revoked token can be restored later from the same step (its secret stays valid).
• Delete — permanently remove the token (the trash icon on the card). Unlike revoke, a deleted token cannot be restored; deletion is confirmed in a separate dialog.

Token lifetime

The Lifetime step offers presets — In 7 days, In 30 days, In 90 days, In 1 year, Never, and Custom date — with Never as the default. A finite preset expires at the end of that day in your browser's timezone (not at an arbitrary minute), and Custom date opens a date picker for any future day. Only the resulting absolute moment is stored, never a relative "7 days" rule, so the expiry does not shift if you edit the token later. When creating a token you cannot pick a date in the past; when editing, a back-dated expiry is allowed and acts as a soft-revoke.

Expiry and revocation are enforced on every request by the backend resolver — for both the raw popout token and the short-lived session it is exchanged for on load (the OBS session cookie). An expired or revoked token is rejected exactly like an invalid one, without disclosing which state it is in.

Audit — actions performed via a popout token are attributed in the audit log either to the assigned member (if set) or to the token's creator.

Security Notes

• A popout token is a bearer credential — anyone with the URL has the same access. Treat it like a password.
• On load the raw token is swapped for a short-lived session cookie and dropped from the live URL and WebSocket URL, so it no longer lingers where a screen share or proxy log can catch it mid-stream. The URL you store (in OBS, a bookmark, a stream-deck button) still contains the raw token, though — so the storage points below still matter.
• URLs are visible in browser history, screen shares and OBS scene exports. Use a member assignment + minimum-permission set so a leaked token can't be abused.
• Revoke tokens immediately if a streamer leaves your team or if you suspect a leak.
• Never paste a popout token into a public chat, ticket, or screenshot.

API

Type	Endpoint	Permission
GraphQL Query	popoutTokens	tokens:read
GraphQL Query	myPermissions	any authenticated — used by popout pages to know what they can render
GraphQL Mutation	createPopoutToken(input)	tokens:create
GraphQL Mutation	updatePopoutToken(id, input)	tokens:edit
GraphQL Mutation	deletePopoutToken(id)	tokens:delete
REST	GET /v1/tokens	tokens:read
REST	GET /v1/tokens/me	any authenticated — returns the current caller's resolved permission set
REST	POST /v1/tokens	tokens:create
REST	PATCH /v1/tokens/\{id\}	tokens:edit
REST	DELETE /v1/tokens/\{id\}	tokens:delete