Realtime tokens exist so a browser can connect without a server key; scoping them protects each patient's chat room from every other user. Give each browser a short-lived token limited to its authorized room, then revoke it when the session ends. The deciding constraint is presence accuracy: after a reconnect, the server must still know who may join which room, without trusting stale UI state.

TL;DR: A realtime token lets a browser open a connection without ever receiving the server key. Its scope is the platform-enforced authorization boundary that prevents one user from subscribing to another user's channel. Short lifetime plus revocation makes logout apply to sockets, including reconnecting ones.

This is easy to blur into "another login token." It's more specific. The application server authenticates the user, decides the allowed room, and asks the realtime system for a restricted credential. The browser gets that credential.…