Tokens

Generate popout tokens for browser sources, dashboards, and other unattended views that need access to your channel without a logged-in browser session. Open Settings, select the channel, then choose Access → Popout Tokens (/dashboard/settings/channel/tokens). A token link is a secret: treat it like a password. API keys authenticate programmatic API calls; popout tokens authenticate popout views such as OBS browser sources.

What Are Popout Tokens?

Popout tokens (prefix lm_pop_) are secret strings that authenticate a single URL without your browser cookies. By default they never expire, but you can optionally set an expiry time or revoke a token at any point (see Token Management). They are designed for:

• Browser sources - drop a URL with ?token=lm_pop_… into OBS, no login UI required
• Stream-deck buttons - open a popout view directly to a control surface
• Shared dashboards - give a moderator read-only access to a single view
• Remote control overlays - receive live events on another machine

Creating a Token

Creating a token opens a full-screen wizard over the settings window with three steps. Choose New Token in Access → Popout Tokens to start:

1. Identity - optionally enter a label (only for your reference) and choose who the token belongs to. Leaving the assignment on Yourself binds the token to you; pick a member to attribute its actions to that user instead. Every token is always bound to someone - removing a member assignment later binds the token to you, the person editing it. You can only pick a member whose role has no permission you lack yourself, so only someone holding every permission can assign a token to the account owner.
2. Permissions - tick the permissions the token may use (e.g. events:read, events:create, events:userinfo, overlays:read, spotify:read, spotify:playback, chat:read, chat:write, chat:userinfo, chat:ban, chat:timeout, chat:delete, chat:notes). The chat:userinfo / events:userinfo scopes are what let a popout open the user info card when you click a name (profile, follow status, moderation log); leave them unticked for a display-only browser source. You can only select permissions you hold yourself - ones outside your own access are shown disabled. At least one permission is required before you can continue.
3. Lifetime - choose when the token expires (see Token lifetime below). The default is Never.

Click Create token on the last step, then copy the full token immediately - the secret is shown only once on the final screen. That screen has no close (✕); press Done when you have copied the token.

A token can never grant more permissions than the user who creates or edits it. This is enforced on both the create and the edit path (identically on the GraphQL and REST APIs): if you request a permission you do not currently hold, the request is rejected. If the member a token is assigned to loses a permission later, the token stops using it on the next request; it works again if the member gets the permission back.

Using a Token

Append the token as a ?token= query parameter to any URL that supports popout authentication:

https://lumio.vision/popout/events?token=lm_pop_xxxxxxxxxxxx

On the first load, the raw token in the URL is exchanged once, server-side, for a short-lived popout session (a 15-minute httpOnly cookie), and the page redirects to the token-less URL. From then on the raw token no longer appears in the address bar, the WebSocket URL, or any network request - WebSocket subscriptions, REST proxy calls, and SSR data all authenticate through the session cookie. The session is refreshed transparently for as long as the token stays valid, so a browser source can stay open indefinitely.

You still only pass the token once in the URL. Saved URLs keep working: an existing OBS browser source whose stored URL contains ?token=lm_pop_… is exchanged automatically on load - no setup breaks.

Where Popout Tokens Work

Lumio exposes five popout pages plus the overlay route. Popouts live on the dashboard host (lumio.vision) and accept ?token= for popout-token auth. Overlays live on their own host (overlay.lumio.vision) and carry their own access token, which is not a popout token - you get the complete URL from Copy Link on the overlay card.

URL	Host	What it shows	Recommended permissions
/popout/events	lumio.vision	Live event feed (followers, subs, cheers, raids, redemptions, tips) with channel-status indicator	events:read (+ events:userinfo to open the user info card from event rows)
/popout/test-events	lumio.vision	Test-event catalog and sending confirmation, usable as an OBS dock from 320 px width	events:create (required to show the catalog and send)
/popout/chat	lumio.vision	Unified multi-platform chat view with moderation actions	chat:read (+ chat:write to send, chat:ban/chat:timeout/chat:delete to moderate, chat:userinfo to open the user info card from chat rows)
/popout/music	lumio.vision	Spotify "now playing" widget with playback controls	spotify:read and connections:read for channel status (+ spotify:playback to control playback)
/popout/obs	lumio.vision	OBS Remote control panel (scenes, stream/recording state)	settings:read
/overlay/\{key\}	overlay.lumio.vision	Any overlay, rendered as a browser source	none - the overlay's own access token is already in the URL
/overlay/\{key\}/preview	overlay.lumio.vision	Preview of an overlay inside the dashboard	same as above

Overlays are intentionally separate: each one has its own access token, minted for the overlay rather than for a person, and revocable on its own from the overlay's menu. Loading /overlay/\{key\} without that token returns "403 - Access token required". See Overlays.

The Test-Events popout uses the same searchable catalog as the dashboard side sheet. A popout link must carry events:create in its own permission list. If it does not, the page says This popout link is missing a permission and sends nothing. A signed-in browser uses the current user's permissions. Tests appear in overlays and dashboard activity, not in the Events popout or stored history. The dashboard Popouts ▾ menu opens or copies the token-free page URL; create the token under Tokens for a delegated OBS dock.

Browser Source Setup

1. Create the popout token with the permissions you need (for /popout/events you only need events:read) and copy the secret on the final screen - it is never shown again
2. Build the URL yourself: take the popout page you want and append ?token= plus the secret, e.g. https://lumio.vision/popout/events?token=lm_pop_…
3. In OBS: Add → Browser, paste the URL
4. Width/height: 400×600 for chat, 600×120 for music, 500×400 for events, or at least 320 px wide for the Test-Events dock (rule of thumb)
5. Custom CSS (optional): body { background: transparent; } if the popout doesn't already render transparent
6. Optional: during a season the popout wears the seasonal look of the token's user. Append &season=off, &seasonStrength=subtle (colours only) or &seasonMotion=off (no animations) to change it for this URL only - the final screen of the wizard lists these parameters next to the token

Token Management

The list groups tokens into Active, Expiring soon, and Revoked & expired. The last group starts collapsed; expand it to inspect or restore a revoked token. Open a token row to see permissions grouped by category, its assigned member, prefix and usage dates, then use its edit, revoke or delete actions. Rows stack their details on a phone or narrow window.

Each token in Settings → Channel → Access → Popout Tokens shows an always-visible status line - Never expires, Expires on {date}, Expired on {date}, or Revoked on {date} - alongside a badge that flags a token that is Expired, Revoked, or Expiring soon (within 7 days of its expiry). Each card also shows the assigned member - or Unknown member when your role cannot resolve member names (members:read) - plus when the token was created and last used. Clicking the pencil icon opens the token in the same three-step wizard, where you can jump straight to any step:

• Edit - change label, assigned member, or permissions any time; Save is available on every step and only submits the fields you actually changed.
• Set an expiry - on the Lifetime step, pick a preset or a custom date (see Token lifetime); the token stops working automatically after that moment. Choose Never to make the token non-expiring again. An already-expired token can be pushed back into the future here - its status updates accordingly.
• Revoke - on the Lifetime step, mark the token revoked without deleting it; all popout URLs using it stop working immediately. A revoked token can be restored later from the same step (its secret stays valid).
• Delete - permanently remove the token (the trash icon on the card). Unlike revoke, a deleted token cannot be restored; deletion is confirmed in a separate dialog.

Token lifetime

The Lifetime step offers presets - In 7 days, In 30 days, In 90 days, In 1 year, Never, and Custom date - with Never as the default. A finite preset expires at the end of that day in your browser's timezone (not at an arbitrary minute), and Custom date opens a date picker for any future day. Only the resulting absolute moment is stored, never a relative "7 days" rule, so the expiry does not shift if you edit the token later. When creating a token you cannot pick a date in the past; when editing, a back-dated expiry is allowed and acts as a soft-revoke.

Expiry and revocation are enforced on every request by the backend resolver - for both the raw popout token and the short-lived session it is exchanged for on load (the OBS session cookie). An expired or revoked token is rejected exactly like an invalid one, without disclosing which state it is in. A popout that is already open notices within about 30 seconds: its live connection is checked again and closed once the token is revoked, expired or deleted.

Assigned member leaves - a token assigned to a member stops working once that member is no longer part of the account. When you remove the member (or they leave), the tokens assigned to them are deleted, and any of their popouts that are still open close within about 30 seconds. Tokens bound to other members are not affected.

Audit - actions performed via a popout token are attributed in the audit log to the member the token is bound to (the creator, unless you picked someone else).

Security Notes

• A popout token is a bearer credential - anyone with the URL has the same access. Treat it like a password.
• On load the raw token is swapped for a short-lived session cookie and dropped from the live URL and WebSocket URL, so it no longer lingers where a screen share or proxy log can catch it mid-stream. The URL you store (in OBS, a bookmark, a stream-deck button) still contains the raw token, though - so the storage points below still matter.
• URLs are visible in browser history, screen shares and OBS scene exports. Use a member assignment + minimum-permission set so a leaked token can't be abused.
• Tokens assigned to a member are removed automatically when that member leaves the team. A token bound to you keeps working when someone else who used it leaves - revoke it yourself in that case, and revoke any token immediately if you suspect a leak.
• Never paste a popout token into a public chat, ticket, or screenshot.

API

Type	Endpoint	Permission
GraphQL Query	popoutTokens	tokens:read
GraphQL Query	myPermissions	any authenticated - used by popout pages to know what they can render
GraphQL Mutation	createPopoutToken(input)	tokens:create
GraphQL Mutation	updatePopoutToken(id, input)	tokens:edit
GraphQL Mutation	deletePopoutToken(id)	tokens:delete
REST	GET /v1/tokens	tokens:read
REST	GET /v1/tokens/me	any authenticated - returns the current caller's resolved permission set
REST	POST /v1/tokens	tokens:create
REST	PATCH /v1/tokens/\{id\}	tokens:edit
REST	DELETE /v1/tokens/\{id\}	tokens:delete