Accept X-***-Token on REST + signed ?st= stream tokens on audio endpoints

Shipped

July 15, 2026 at 7:06 PM UTC

Author

Kamo

Commit

6046a6b

OTKValidationFilter precedence: X-OTK → X-***-Token → ?st= (GET, audio streaming paths only, verified via shared StreamTokenCodec with internal.auth.secret; claims feed the controllers' existing org/member authorization). Native players can now Range-request recordings/voicemails.