Authorize a visitor realtime channel

POST 
/api/widget/broadcasting/auth

PUBLIC Pusher-compatible broadcasting authorization for anonymous widget visitors (the staff /broadcasting/auth endpoint requires Sanctum, which a visitor lacks). Used as the Pusher/Echo authEndpoint by the widget client.

A visitor may authorize ONLY the private channel of their OWN conversation — private-tenant.{tenantId}.conversation.{conversationId} for the tenant and conversation in their session token. Any other channel (another conversation, the agents presence channel, a user's personal channel, a different tenant) is DENIED (403). The conversation comes solely from the token, so cross-conversation / cross-tenant subscription is impossible.

Request

Responses

200

The signed Pusher authorization payload.

403

Missing / invalid / cross-tenant token, or an attempt to authorize a channel other than the visitor's own conversation.

404

Unknown or missing widget_key.