Display Token and Security Model

Overview

A Q&A session has two privileged surfaces beyond the public participant view: the Host Panel (moderation) and the Display View (projection). They use different security primitives because their threat models differ.

This page documents both, including PIN and join-code regeneration, and the ProPresenter integration deep dive.

Display Token

When a session is created, the system generates a 32-character cryptographically random token and saves it with the session. The token is then embedded in the public Display URL, which you copy directly from the host panel or the admin session page rather than typing by hand.

Anyone who possesses this full URL can open the projection display without entering the Host PIN. The display is read-only -- the token does not authorize any write actions; it only unlocks the projection view.

Why a Token Instead of the PIN

The PIN is short and human-typable. Embedding it in a URL would expose it in browser history, screen recordings, and in any "Recent URLs" UI on shared computers. The token, by contrast, is long enough that brute-forcing is infeasible (32 random alphanumeric characters give roughly 190 bits of entropy). The token is also scoped to the read-only display only, so even if it leaks the worst case is "someone watches the projection feed remotely" -- they cannot moderate or delete content.

Where to Find the Display URL

In the host panel, open the Display settings popover (the projector/display button in the panel chrome). The Display URL field at the bottom of that popover contains the full token URL. Click Copy to copy it to your clipboard.

It also appears on the admin session detail page (Q&A -> open the session) in the Display URLs card. That card lists two URLs:

• Public Display URL -- badged No PIN required. This is the token URL; send it to your media team for ProPresenter, OBS, or any projector browser. Read-only -- recipients can view but not moderate.
• Host Display URL -- badged PIN required. For your own preview from a logged-in browser; it prompts for the host PIN if you're not already authenticated.

If the Display URL Leaks

There is no separate "regenerate display token" action -- the token is generated once at session creation and stays stable for the life of the session, even across status transitions (Live -> Closed -> Archived). This is intentional so projection feeds keep working without re-pasting URLs mid-service.

If the Public Display URL is exposed somewhere it shouldn't be (for example, posted publicly in a Facebook event by mistake), the practical containment options are:

• Close or archive the session so the Display View stops serving live content (see "When the Token / PIN Stops Working" below).
• Regenerate the join code and Host PIN to protect the participant and host surfaces (these do have one-click regeneration).

Remember the leaked token is read-only: a leak exposes the projection feed for viewing only -- it never grants moderation or delete rights.

Host PIN

The Host PIN is a 6-digit numeric code generated at session creation. The PIN gate is documented in Permissions and Roles -> Host PIN. To recap:

• Saved with the session.
• Required on first access to the host panel from any device.
• On a correct entry, a session-scoped cookie is set on the device. The cookie is bound to that one session; entering the PIN for one session does not authenticate any other session.
• Cookies are not persisted across browser private mode / incognito sessions.

Regenerating the PIN

On the admin session detail page, click Regenerate PIN (in the regeneration card). Effects:

• A new 6-digit PIN is generated.
• All existing host sessions for this session are invalidated -- every device with the panel open will be re-challenged on its next refresh.
• The Display Token is not affected; projection feeds keep running.

Use this when the PIN has been shared too widely or when a moderator volunteer is no longer trusted.

Regenerating the Join Code

The same card also has Regenerate code, which issues a new join code (and invalidates the current QR / short links). Confirm the prompt before doing this -- any printed or shared join links and the current QR will stop working.

Regenerating the join code does not affect the Host PIN or the Display Token.

Threat Model Summary

What each gate protects against:

ProPresenter Integration -- Deep Dive

ProPresenter has first-class support for web content slides, which is the recommended way to embed the Q&A display. The token URL is designed for this exact workflow.

Setup

1. Get the URL. In the host panel, open the Display settings popover and copy the Display URL value -- or use the Public Display URL from the Display URLs card on the admin session detail page.
2. Create a Web slide in ProPresenter. In your service playlist, add a new slide and choose Web as the slide type.
3. Paste the URL into the Web slide's URL field.
4. Set "Auto Refresh" to OFF. The display refreshes itself every 3 seconds (every 15 seconds when the tab is hidden). ProPresenter's auto-refresh would interrupt animation continuity.
5. Set "Show in Show" to ON. This keeps the web view rendered even when not the active slide, so when you cut to it the page is already loaded and connected.
6. Optional: Enable Audio: OFF. The Display View has no audio, but turning this off prevents ProPresenter from creating an audio context.

Tips

• Pre-load before the service. Make the Web slide active for a few seconds during your pre-service walk-through. The slide will connect, fetch the current state, and stay synced from then on.
• Theme tuning. Set the projection theme and font size from the host panel before the service. The Display View picks up changes in real time, but you don't want to be fiddling with colors while the service is running.
• Full-screen. ProPresenter's web slide renders in the slide canvas. The display auto-hides the cursor after a few seconds of inactivity; no further full-screen action is needed.
• Network reliability. The display refreshes on a short interval, which means transient network blips just produce a brief stale-state window of up to 3 seconds. There is no reconnection storm; once the network recovers, the next refresh catches up.

OBS Integration

For livestreams using OBS:

1. Add a Browser Source.
2. Paste the Public Display URL.
3. Set width/height to your output resolution (typically 1920x1080).
4. Tick "Shutdown source when not visible" to OFF (keep it loaded).
5. Tick "Refresh browser when scene becomes active" to OFF (let the page manage its own refresh).

The Display View is responsive and renders cleanly at 1920x1080. If your stream uses a non-standard aspect ratio (vertical mobile, ultrawide), adjust the browser source size and the display's font-size setting to fit.

When the Token / PIN Stops Working

A few normal cases where the gates start denying:

• Session is archived or deleted. Both Display View and Host Panel return the public "Session ended" page in this state -- the gates aren't queried.
• Wrong or missing key in the Display URL. A typo'd or truncated URL is rejected outright rather than silently dropping to PIN entry, so a broken shared URL fails loudly. Re-copy the full URL from the host panel or the admin Display URLs card.
• PIN was regenerated. Re-enter the new PIN on the host device.
• Cookies cleared on the host device. Re-enter the PIN.
• Different browser / different device. Each device authenticates independently.

If you're stuck on the host side, the fastest reset is: open the session detail page in the admin area, click Regenerate PIN, then re-enter the new PIN on the host's phone. For the projection feed, re-copy the Public Display URL and re-paste it into ProPresenter or OBS.

Previous: Archive and Data Retention