Copied from ConnectToken.AuthProvider — how the user signed in: google, microsoft, apple,
facebook, signicat, email, passkey or sso. Empty for a guest, and for a sign-in that
predates the platform recording it, which is not the same as any one method. Signed by the
backend, so an app may rely on it, for example to require that its enterprise users came in
through their organisation's IdP.
Copied from ConnectToken.InitialUrl — the absolute URL the browser loaded, so an app can see the
host it was reached on (a custom customer domain) and not just the path. A strict superset of
InitialPath: same SDK-internal ikon-* query params stripped, everything else kept, so
InitialUrl.PathAndQuery reproduces InitialPath. Empty for every non-browser client, so read it as
an addition to InitialPath rather than a replacement. Client-controlled like InitialPath — treat
it as a hint and re-authorize server-side; it must never gate anything security-relevant on its own.
Copied from ConnectToken.IsAnonymous — true when the user is anonymous (guest login or no
login): a device-scoped identity rather than a real account. The authoritative signal for
guest detection; AuthSessionId is a login-session identifier, not an authentication flag.
Copied from ConnectToken.IsGlobal — true when this anonymous user is the space's GLOBAL
communal identity (the "global" login method), where every global visitor shares one UserId.
Always false for device-scoped guests and signed-in users; implies IsAnonymous. Lets an app
offer "continue as guest" or per-visitor features only where they make sense.
Opaque, monotonically-increasing capability level advertised by the connecting SDK (companion to SdkType).
0 = legacy/unknown. Copied from ConnectToken.SdkCapability when the server builds the client Context.
Copied from ConnectToken.SnapshotVariant — the boot-snapshot variant id the capture client asks
the app to render; empty for route captures and all live clients. Client-controlled like
IsSnapshot — must never gate anything security-relevant.
Copied from ConnectToken.SsoConnectionId — the space's SSO connection the user signed in through;
empty unless AuthProvider is sso. What an app compares against the connection it assigned to one
of its tenants.
Copied from ConnectToken.TestLinkId / TestLinkName — set when this session came in through a
test link the app's makers minted. A guest that is also a tester: the feedback button is offered
whatever the audience setting, and its reports carry the link's name. Empty otherwise.