# Your session rules decide who gets to subscribe.

There is no permission model to configure in Bird. A private or presence subscription is approved by an endpoint you write, using the session you already have, and signed with a secret only your servers hold. Bird verifies the signature; you decide the policy.

## One key is public. One is not.

## Everything follows from that split.

Every app on the Bird Realtime API has a key and a secret. The key is meant to ship in client code; the secret authenticates your server's calls and signs subscriptions, and it is shown once, at creation. Anyone holding it can publish to your app and forge a presence identity, so treat it like a database password. Rotation is additive rather than disruptive: create a second key, deploy it, then revoke the old one.

## Four controls, four questions

Who may subscribe, who may hold a connection, who can read a payload, and who is still allowed in.

## What authorization does not do.

Requiring authorized connections controls who may hold a socket open. It does not change who can read a channel: a public channel stays readable by every authorized connection, so events that belong to one customer belong on a private channel whose name your endpoint checks. And because your endpoints are the authority, a permissive endpoint hands out access as freely as a leaked key would. The same honesty applies to client events, which the edge does not validate: use them for signals, and route anything authoritative through your server.

## Where the data sits.

An app picks its region when you create it and keeps it for life, so you choose the one closest to your users, and an app's region can differ from your workspace's home region. Apps are also the isolation boundary: two apps never see each other's channels, which is what makes one app per environment the right way to keep staging traffic out of production.

## Go deeper in the docs.

Authorizing channels has the request and response contract and the exact string to sign. Requiring authorized connections covers the 30-second window and code 4009, encrypted channels covers key generation and rotation, and terminating member connections is the sign-in and disconnect flow.

## Ship the key. Keep the secret.

Signed subscriptions, authorized connections, and encrypted channels are part of every Realtime app, on every plan.