The symmetric key / connection token is generated with netcode_generate_connect_token. This is normally done on your authentication server, which runs over nor

The symmetric key / connection token is generated with netcode_generate_connect_token. This is normally done on your authentication server, which runs over normal HTTPS. Thus the workflow is basically like this: - Web browser connects to like https://auth.myapp.com https://auth.myapp.com. This can either be part of the login process or server discovery, it's totally up to you and specific to your app. This service calls netcode_generate_connect_token and returns the symmetric key / connection token in the response. - The client then uses this symmetric key / connection token when calling netcode_client_connect. - And you're done, you can now use the rest of the netcode APIs. The second thing that you mentioned isn't required. The token is unique to the client already, so a server can confirm that it's a specific client connecting.