Sessions and client tokens
How the React SDK uses short-lived client tokens created by your server.
The React SDK uses client tokens to authenticate with the Fency.ai API. Client tokens are short-lived credentials that your server creates by calling the Fency API. Sessions control access to memories: you decide which memories each session can access when creating it via guardrails. This architecture keeps your secret key secure on the server while allowing your React app to make authenticated requests.
How it works
- Client SDK initiates the request: When the React SDK needs to make API requests (e.g. for creating a new stream), it calls the
fetchCreateStreamClientTokenfunction you pass toFencyProvider, which requests a client token from your server endpoint (e.g./api/stream-client-token). - Server creates a session: Your backend receives the request and calls the Fency API with your secret key. The API returns a session object that includes a
clientToken, which your endpoint returns to the frontend. - SDK uses the token: The React SDK receives the
clientTokenand uses it to authenticate with the Fency.ai API.
Session types
Different session types support different features. A stream session enables basic streaming, while an agent task session is required for chat completions (streaming, structured, or memory-based). Your server endpoint should create the appropriate session type for the features your React app needs.
Security
Client tokens are scoped to a single session and expire after use or when the session ends. They never expose your secret key. By creating sessions on your server, you maintain full control over who can obtain client tokens and can enforce your own authentication and rate limiting before creating sessions.