Direct answer
TweetStream uses API-key authentication for WebSocket and REST access, with account management handled inside the authenticated product.
API key access
TweetStream API access is scoped through generated API keys. Clients should keep keys server-side where possible and rotate them when access changes.
- WebSocket auth via
tweetstream.auth.token.<API_KEY>subprotocol - REST auth via
Authorization: Bearer <API_KEY> - Dashboard-based account and key management
Integration guidance
The WebSocket stream is intended for monitored public social signals and enrichment metadata. Do not expose API keys in public front-end code.
Enterprise review
For enterprise security reviews, use the contact route so limits, access model, and deployment needs can be documented before rollout.