A five-minute token for the notifications WebSocket, bound to the caller's profile and to that socket's audience (2026-09-28).

The socket used to take the Firebase session cookie on its URL, which meant the dashboard returned that five-day, every-route credential to page script. This token is what page script gets instead: the socket verifies its signature, audience and expiry (notification_socket_token.verify_socket_token) and maps it to the profile; the API's bearer chain does not accept it at all. The caller proves who they are with their ordinary credential to reach this route.