secure realtime endpoint with access tokens