Browser access

Never ship an nvk_… machine credential in browser code. Browser-direct access uses a short-lived client token minted by your backend, or an anonymous token issued for an App that explicitly enables anonymous visitors.

A verified browser grant pins one exact Agent revision plus tenant, user, Conversation, MemorySpace, tool, and limit constraints. Browser admission does not accept behavior or machine scope headers because the token already carries that authority.

Create a browser client

import { createBrowserClient } from "@deepnoodle/nvoken";
 
const browser = createBrowserClient({
  baseUrl: window.ENV.NVOKEN_BASE_URL,
  clientToken: async () => {
    const response = await fetch("/api/nvoken-token");
    return (await response.json()).token;
  },
});
 
const turn = await browser.start("Help with this order.", {
  conversation: {
    key: "support",
    ownedByUser: "user-481",
    ifActive: "interrupt",
  },
});
 
for await (const update of turn.updates()) {
  render(update.snapshot);
}

Prefer a token function. Client tokens live at most 15 minutes, so a long-open page needs to refresh through its own backend.

Anonymous visitors

issueAnonymousToken() exchanges an allowlisted browser origin and App ID for a narrow visitor token. Persist the returned visitor token and present it on renewal to keep the same visitor partition and Conversation. Anonymous work is memoryless.

Browser authority is deliberately smaller than machine authority: no credential, provider-key, usage, App, Org, or arbitrary Agent management.