> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nozle.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Backend-authorized updates

> Keep entitlement UI current without exposing customer credentials

Nozle customer state is server-authorized. Publishable keys cannot read customer entitlements or mint realtime tokens.

## Recommended baseline

Refresh through your authenticated backend after events that can change access:

* checkout completion confirmed by your backend;
* plan changes or cancellation;
* usage approaching or crossing a limit; and
* administrative entitlement changes.

```ts theme={null}
const response = await fetch('/api/billing/entitlements', {
  credentials: 'include',
})

const entitlement = await response.json()
```

## Push delivery

Applications that need push updates can use a server-authorized realtime channel:

1. authenticate the application user on your backend;
2. derive the Nozle customer or workspace from server-owned records;
3. issue a short-lived, narrowly scoped token; and
4. publish only the customer fields required by the UI.

Do not send a Nozle `pk_` or `sk_` credential to the WebSocket endpoint.

## React integration

The current React SDK provides presentational gates. Store your authenticated backend result in your application state and pass `allowed`, `loading`, plan, and usage values to those components.

```tsx theme={null}
<FeatureGate allowed={state.analyticsAllowed} loading={state.loading}>
  <Analytics />
</FeatureGate>
```

This model keeps the authorization boundary on the server while allowing polling, request-driven refresh, or your own realtime transport.