The live-thumbnail and manual /start,/stop sidecar->mam-api calls hit the CSRF
guard (403 missing X-Requested-With). Match the working pattern in index.js:
send Authorization: Bearer $MAM_API_TOKEN (= CAPTURE_TOKEN, injected by
recorders.js), which is CSRF-exempt. Falls back to the UI header only when no
token is set (dev). Fixes [livethumb] failed ... 403 — posters now persist.
🤖 Generated with Claude Code
|
||
|---|---|---|
| .. | ||
| capture | ||
| mam-api | ||
| node-agent | ||
| playout | ||
| premiere-plugin | ||
| premiere-plugin-uxp | ||
| web-ui | ||
| worker | ||