Skip to main content

Subscribe via SSE

The vault event stream is a standard SSE endpoint. Any HTTP client that supports Server-Sent Events can subscribe: browsers, Node.js, Python, curl, or AI agents.

Authentication

The SSE endpoint requires a Bearer token — either your API key or a vault access token:
Use vault access tokens when subscribing from a browser or agent — do not expose your API key.

From a browser (JavaScript)

From Node.js

SSE event format

Each event follows the standard SSE format:

Replay missed events

The SSE endpoint supports Last-Event-ID for replaying missed events from the last known position:
Events are replayed from the specified event ID onward. This allows reconnecting after a dropped connection without missing events.

Stream termination

The stream closes automatically when:
  • The vault is sealed (vault.sealed event fires, then connection closes)
  • The vault expires
  • The access token expires
After the stream closes, re-subscribing to a sealed vault returns all historical events immediately followed by the vault.sealed event.