What authentication does The Mercure protocol use?

The hub accepts a JWT bearer token via the standard Authorization header, preferred for server-to-server calls, or a cookie named mercureAuthorization for browsers. JWT claims constrain which topics a publisher can write to and which a subscriber can read. Through Jentic, JWT signing keys live in the credential vault and the agent gets a scoped Jentic token.

Can I publish to multiple topics in a single Mercure call?

Yes. POST /.well-known/mercure accepts repeated topic form fields, so a single update can be delivered to several topic IRIs at once. This is the standard way to fan out one event to multiple groupings, for example a per-user inbox topic plus a global feed topic.

What are the rate limits for The Mercure protocol?

The protocol itself does not define rate limits; these are enforced by the hub deployment. The reference Mercure hub supports thousands of concurrent subscribers per process and limits are set in hub configuration rather than in the spec, so production rollouts should size the hub for peak concurrent SSE connections.

How do I publish a Mercure update through Jentic?

Install the SDK with pip install jentic, search for 'publish a Mercure update', load the POST /.well-known/mercure operation, and execute it with the topic IRI and JSON data. Jentic attaches the JWT and posts to the configured hub URL.

Does Mercure support private updates only some subscribers can read?

Yes. The publish endpoint accepts a private flag and a list of mercure.publish or mercure.subscribe topic selectors in the JWT. The hub only delivers the update to subscribers whose JWT grants them access to the matching topic IRI.

Can I limit what my agent is allowed to do with the Mercure API?

Yes. Because you run Jentic One yourself, your own rules decide which Mercure operations and credentials the agent may use, so you can grant only what a given agent needs. You can restrict it to publishing updates with POST /.well-known/mercure, or limit it to the read-only introspection endpoints such as GET /.well-known/mercure/subscriptions, while keeping every other operation out of reach. Note that Mercure passes the topic in the request body when publishing rather than in the URL path, so scoping is done at the operation level; the one topic that does appear in the path, /.well-known/mercure/subscriptions/{topic}, is read-only. This lets an operator, for example, allow an agent to broadcast progress events but never inspect who is subscribed.