Authentication - Talview Docs

Authentication is handled by the auth module. Unlike session(), playback(), form(), and scheduler(), it loads automatically — you do not declare it in the modules array. Its strategies live on the Proview.auth namespace and are passed as credential on Proview.init():

await Proview.init({
  dsn: 'YOUR_PROJECT_DSN',
  credential: Proview.auth.TokenAuthStrategy({ token: 'session-token' }),
  modules: [
    Proview.playback(),
  ],
});

The credential is declared once and inherited by every module in the modules array.

Strategies

Strategy	Use it for
`Proview.auth.DefaultAuthStrategy()`	The implicit default. Applied when `credential` is omitted.
`Proview.auth.TokenAuthStrategy({ token })`	Passing a token your backend obtained from Talview. Required by playback.
`Proview.auth.FirebaseAuthStrategy({ token })`	Integrations that already authenticate users through Firebase.

`DefaultAuthStrategy`

If you do not pass credential, the SDK falls back to DefaultAuthStrategy. These two are equivalent:

await Proview.init({ dsn, modules: [Proview.session()] });

await Proview.init({
  dsn,
  credential: Proview.auth.DefaultAuthStrategy(),
  modules: [Proview.session()],
});

Declare it explicitly when you want the choice to be visible in your code rather than implied by an omission.

`TokenAuthStrategy`

Takes a token your backend obtained from the Talview token endpoint:

credential: Proview.auth.TokenAuthStrategy({ token: 'session-token' })

Use it whenever the SDK needs to act on behalf of a specific user whose identity only your application can vouch for. Playback is the clearest case — see Playback → Authentication for why.

Where the token comes from. Talview provides the token API as part of your integration — the endpoint and the request format. Contact Talview if you have not received these details.

`FirebaseAuthStrategy`

For applications already using Firebase Authentication:

credential: Proview.auth.FirebaseAuthStrategy({ token: 'your-token' })

Choosing a strategy

Module	Strategy
`playback()`	`TokenAuthStrategy`
`form()`, `scheduler()`	`FirebaseAuthStrategy`, or `DefaultAuthStrategy` if you are not using Firebase
`session()`	`DefaultAuthStrategy` — proctoring identifies the attempt through the `dsn` and the identifiers passed to `Proview.session.init()`

Handling tokens safely

Request the token from your backend, not the browser. Your server calls the Talview token endpoint and passes the result to the page, so the endpoint’s own credential never reaches the browser.
Do your own authorization check first. Talview issues the token; deciding whether this user should have it is your application’s job.
Treat it like a session credential. Keep it out of URLs, logs, and analytics payloads. Never ship a shared long-lived token to the browser.

Troubleshooting

A rejected or insufficient credential surfaces through the global error handler as AUTH_ERROR or UNAUTHORIZED. See the Error Reference for the full list, and Troubleshooting → Authentication failures for diagnosis.

​Strategies

​DefaultAuthStrategy

​TokenAuthStrategy

​FirebaseAuthStrategy

​Choosing a strategy

​Handling tokens safely

​Troubleshooting

Strategies

`DefaultAuthStrategy`

`TokenAuthStrategy`

`FirebaseAuthStrategy`

Choosing a strategy

Handling tokens safely

Troubleshooting