Session & proxy

Core runtime contract for education apps. Follow this page and stay Hub-implementation independent.

URL contract

Edu opens your app as:

{hostedUrl}?session={TOKEN}&proxy={PROXY_BASE}

Param	Required	Description
`session`	Yes inside Edu	Student/teacher runtime token
`proxy`	Recommended	MCP proxy base; else production default

https://edu.daven.ai/api/v1/mcp-proxy

http://localhost:3001/api/v1/mcp-proxy

Never put MCP / Daven API keys in the browser or frontend env. Only the Hub server holds keys.

Send the session on every request. Prefer both:

Authorization: Bearer {session}
X-Edu-Session: {session}

Some GETs also accept ?session=. Prefer headers.

Hub iframe is roughly:

sandbox="allow-scripts allow-forms allow-same-origin"

Sihwa Studio: