SessionAccessToken

The unguessable per-session secret that gates a LAN-reachable server.

It is the first path component of every URL the session publishes (http://10.0.0.7:51234/<token>/master.m3u8) because that is the only channel AirPlay gives us: the receiver fetches the playlist and its segments with its own HTTP client, and nothing in the HLS handoff lets us attach a header to those fetches. The header form exists for hosts that drive the server themselves.

192 bits from the system CSPRNG. Sized so that guessing is not a strategy on a network where an attacker can also just try every port: at one guess per packet there is no rate that matters.