> ## Documentation Index
> Fetch the complete documentation index at: https://developers.telnyx.com/llms.txt
> Use this file to discover all available pages before exploring further.

# authorize()

> `protected` **authorize**(`_token`, `_req?`): readonly [`Claim`](/docs/agent-sdk/interface/authorize#claim)\[] | `Promise`\<readonly [`Claim`](/docs/agent-sdk/interface/authorize#claim)\[]>

Policy seam: resolve a connection's credential into its claims (grants).

Called by the default [`webSocket`](/docs/agent-sdk/interface/webSocket) once per
connection — with the token the client attached with (or `undefined` for
a client that never presented one) and the connection's upgrade request,
whose headers carry whatever an authenticating front door stamped on it.
Return the claims to grant; throw to reject the connection. Claims are
application-defined strings; the SDK itself only interprets `"rpc"`,
which a connection needs to invoke [`@rpc()`](/docs/agent-sdk/interface/rpc) methods
remotely.

The default admits every connection as a **read-only watcher** — it
never grants `"rpc"`, and it never validates the token (an unvalidated
credential must not confer rights). Remote RPC therefore requires an
explicit override that verifies the token and/or the request's identity
headers and grants `"rpc"` deliberately.

**Parameters**

| Parameter | Type | Description |
| - | - | - |
| `_token` | `string` \| `undefined` | The credential presented by the client, or `undefined` for a tokenless (anonymous) connection. |
| `_req?` | `Request` | The connection's upgrade request (front-door identity headers ride here), when the host provided one. |

**Returns**

readonly [`Claim`](/docs/agent-sdk/interface/authorize#claim)\[] | `Promise`\<readonly [`Claim`](/docs/agent-sdk/interface/authorize#claim)\[]>

The claims granted to this connection.

**Default Value**

`["read"]` — for every connection, token or not.

## Claim

> **Claim** = `"read"` | `"rpc"` | (`string` & `{}`)

A capability a connection can be granted. Open-ended: custom claims allowed.