Shared Signals

SSF receiver and ephemeral transmitter: discover CAEP/RISC metadata, manage streams, push or poll Security Event Tokens, and verify them.

Privacy: Client-Direct + Server-Proxy. Prefer browser fetch() to the IdP. On CORS failure or confidential clients, fall back to /api/v1/proxy/token. Credentials and assertions are not retained.

What is Shared Signals?

The OpenID Shared Signals Framework lets a transmitter send Security Event Tokens to a receiver so sessions and accounts can be re-evaluated continuously. CAEP covers session and device events. RISC covers account risk events.

This workbench can subscribe to a transmitter such as caep.dev or SecurID, and it can host a short-lived transmitter other receivers can subscribe to.

How to use this tool

  1. Receiver: paste the transmitter issuer, Discover, then create a push or poll stream with a bearer token that has ssf.manage.
  2. Push uses an inbox on this host that answers 202. Poll reads the transmitter poll endpoint.
  3. Transmitter: start a session, give the issuer and bearer to a receiver, then send session-revoked, credential-change, or device-compliance-change.

Frequently asked questions

Does the sandbox transmitter replace an authorization server?

No. The session bearer is a sandbox credential for that issuer only. To call SecurID or caep.dev, paste a token from their authorization server (ssf.manage or ssf.read).

Are streams stored?

Only in this server process, with a local file so a dev reload can restore them. They are for interoperability tests, not a production transmitter.