Real-time updates (SSE)

Assetera's real-time service uses Server-Sent Events (SSE). Your BFF exchanges the server-held Assetera token for a short-lived stream ticket, then the browser opens an EventSource with that ticket.

Connection flow

The browser receives the stream ticket, not the OAuth access token. The ticket is short-lived and restricted to the channels granted by the stream service.

BFF ticket request

For a signed-in user, your BFF calls POST /stream/ticket with the user's Assetera bearer token. Public market channels can also be requested where enabled. Anonymous public streams use the separate guest-ticket route from a tenant service account.

const response = await fetch(`${process.env.ASSETERA_STREAM_URL}/stream/ticket`, {
  method: 'POST',
  headers: {
    authorization: `Bearer ${session.accessToken}`,
    'content-type': 'application/json',
  },
  body: JSON.stringify({ channels: requestedPublicChannels }),
  cache: 'no-store',
});

const { ticket, expiresIn } = await response.json();

Validate the requested public-channel names in the BFF. Do not let a browser ask your backend to mint arbitrary user, tenant, or role channels.

Browser connection

const { sseUrl, ticket } = await fetch('/api/stream-ticket', {
  method: 'POST',
}).then((r) => r.json());
const events = new EventSource(`${sseUrl}?ticket=${encodeURIComponent(ticket)}`);

events.addEventListener('EVENT_TYPE_FROM_YOUR_CONTRACT', (event) => {
  const message = JSON.parse(event.data);
  // Apply the delta to UI state.
});

events.onerror = () => {
  // EventSource reconnects. Refresh the REST snapshot after reconnecting.
};

Correctness model

SSE is a freshness channel, not the source of truth. Start from a REST snapshot, apply live messages, and refresh the snapshot after a reconnect or sequence gap. The exact event names and payload schemas enabled for your integration are supplied with the relevant product API contract.

Security and resilience

• Mint tickets in the BFF. Never put the Assetera access token in EventSource or a URL.
• Treat tickets as sensitive until expiry and avoid logging the query string.
• Allow only the stream origin supplied for the current environment.
• Use exponential backoff with jitter for ticket-mint failures.
• Refresh the REST snapshot after reconnecting because SSE delivery is not a durable replay log.