Authentication

Every request contains a token string. Tokens are UUIDs issued by SeRo Systems. A token grants access to a specific set of sensors.

The server rejects requests with PERMISSION_DENIED if:

• the token is unknown, malformed, or expired

• the token is not associated with any sensors

• a request names a sensor that is not associated with the token

For streaming requests, leave sensor_filter empty to receive data from all sensors associated with the token.

Token Handling

Treat API tokens as credentials:

• do not commit them to source control

• read them from an environment variable, secret manager, or local test file

• redact them from logs and error reports

• rotate them if they were exposed