Realtime: the server tells the app that something changed, the app then asks the ordinary endpoints for the data (so every
privacy rule applies as always). One-way Server-Sent Events over fetch with the access token in a header, so the token is
never in an address. It reconnects by itself (with a growing pause), asks for a fresh token when the old one is gone, and the
server ends a stream before its token would expire: open with reconnected: true is your cue to reload what is on screen.
Direct messages and anything private never travel on it.
Realtime: the server tells the app that something changed, the app then asks the ordinary endpoints for the data (so every privacy rule applies as always). One-way Server-Sent Events over
fetchwith the access token in a header, so the token is never in an address. It reconnects by itself (with a growing pause), asks for a fresh token when the old one is gone, and the server ends a stream before its token would expire:openwithreconnected: trueis your cue to reload what is on screen. Direct messages and anything private never travel on it.