Browser auth rides as a websocket SUBPROTOCOL with this prefix: the ephemeral client secret
is passed as "xai-client-secret." + token. Browsers cannot set request headers on a
websocket handshake, so an Authorization header is impossible — the subprotocol channel is
how the server-minted one-time credential reaches xAI (no API key ever touches the browser).
Browser auth rides as a websocket SUBPROTOCOL with this prefix: the ephemeral client secret is passed as
"xai-client-secret." + token. Browsers cannot set request headers on a websocket handshake, so anAuthorizationheader is impossible — the subprotocol channel is how the server-minted one-time credential reaches xAI (no API key ever touches the browser).