Live user events
A signed-in website session can follow live events for its own application user. The subscription delivers a well-formed event envelope to in-app listeners and ignores anything else. No page starts that subscription today, and no feature command publishes an event, so a visitor does not yet see a live update.
The channel rules and the API publisher are explained in Realtime event channels. Sign-in is explained in Website sign-in.
What the session receives
When application code starts the subscription, the website asks the API for a credential for the current application user. It then opens a private Realtime channel for the topic in that credential and no other topic. Listeners receive an envelope that has an event id, a lowercase kebab-case name, a positive version, an occurrence time, and a payload. A message that is missing those fields is dropped, and the channel stays open for a later valid envelope.
The credential lasts five minutes. Shortly before it expires, the website asks for another one and keeps using it only when the topic is unchanged. Closing the subscription stops further delivery to that browser session. Events published while it was closed are not replayed.
The browser-visible configuration is the public websocket URL, NUXT_PUBLIC_REALTIME_URL. The server publish secret is absent from that configuration and from the credential. The website does not join bot:telegram or another user's channel.
Boundaries
- Session first. The credential is issued only after the website's Supabase Auth session is verified and resolved to an application user. The token subject is that application user id, not the Supabase Auth user id. See Authentication.
- No business screen.
features/user-realtimeowns the connection. The home page does not open a socket from the public URL by itself. - No bot. A trusted server process would use the publish secret to hear every event. The website never receives that secret.