The only requirement is for something that could generate tokens using the api key & secret. Because those keys give a user full access to your livekit instance, they should not be exposed to the user in the client code.
That is the reason why we recommend using our
server SDKs or CLI to
generate a token (which is time-limited and scoped to a particular user).