Data channels

Cloud management, product-user events, and live data use different paths. The product backend authorizes the user, calls the Server SDK for business commands, and publishes product-visible events on its own user real-time channel. For a live data channel, it issues or obtains a short-lived, purpose-scoped descriptor; the frontend then connects to the named endpoint.

Channel	Intended use	Entry point	Integration
Product user events	Chat status, notifications, and product-facing updates	Product backend's authenticated user real-time channel	Subscribe using the product session and ACL
ACP	Agent protocol stream	Backend-authorized ACP descriptor	Connect using the returned transport and scope
Terminal	Interactive shell	Backend-authorized terminal descriptor	Connect using the returned transport and scope
Canvas / A2UI	Structured agent UI	Agent canvas.token; backend-authorized Canvas descriptor	Render authorized UI state
Yjs	Shared document state	Canvas collaboration transport	Authorize document access
WebRTC viewer	Remote device video and input	Backend-authorized viewer descriptor	Exchange signaling and media
Files	Presigned transfer	Server files.prepareUpload; Agent files.presign	Transfer bytes to storage URL

Open the diagram at full size

Do not treat a descriptor as the live connection or as a command API. The frontend uses WebSocket, WebRTC, Yjs, or another declared transport only for the authorized purpose. Check expiration and request a fresh descriptor through the backend when needed. Business CRUD and agent commands travel through the backend and Server SDK; observing a stream is not authority to perform those commands. Never place a bsk_ key in browser or mobile code.

For terminal and ACP integration, use the transport and scope returned by the environment instead of assuming a fixed URL or protocol. Product frontend integration describes the backend boundary; UI and deployment architecture explains A2UI and A2HTML.