| API keys | Authorization: Bearer ..., NULLSPACE_API_KEY, CLI auth config | Authorize SDK, CLI, MCP, and raw HTTP API calls. | Store as account secrets. Do not put them in machine apps or browser URLs. |
| Edge preview tokens | edge_token query parameter in direct preview URLs | Bootstrap direct HTTP and WebSocket preview access for one machine, port, transport, and grant. | Treat the whole URL as a secret; rotate by requesting a fresh preview URL. |
| Preview continuation cookies | Scoped HTTP-only preview cookie set by Nullspace edge after direct HTTP preview bootstrap | Let normal browser navigation continue without preserving edge_token on every subpath. | Browser-managed only. They do not authorize WebSocket upgrades. |
| Preview proxy tokens | x-nullspace-preview-proxy-token header for custom preview proxy upstream requests | Authorize customer-run proxies to forward HTTP or WebSocket traffic to Nullspace edge. | Keep in the proxy server, not in browser-visible URLs or client JavaScript. |
| Private traffic tokens | x-nullspace-traffic-access-token header when allow_public_traffic is false | Add private-traffic authorization on top of direct preview or proxy auth. | Store separately from preview tokens; proxy target responses only return the header name. |
| Desktop viewer tokens | Signed managed desktop viewer URLs | Authorize browser access to managed desktop streams. | Treat viewer URLs as bearer credentials and rotate when sharing ends. |
| SSH relay credentials | Short-lived OpenSSH certificate and matching private key | Authorize SSH relay login. | Keep the private key local; prefer nullspace ssh over legacy signed port-22 WebSocket fallback. |
| File transfer URLs | Signed upload, download, and volume file URLs | Allow direct file transfer without streaming through the SDK process. | Treat as short-lived bearer URLs and avoid logging them. |
