About
One domain for everything you paste, and the backend behind it. The overlays are served from here too, so a stream keeps them even when this dashboard is closed.
Addresses
Who can write what
This dashboard is behind a password, and its own server attaches the backend's credential to the calls it forwards. The token is read from the server's environment at request time — it is not in the page, not in the bundle, and not in any NEXT_PUBLIC_ variable, so nothing here can be read by opening the source.
The overlay pages are behind the same password, but the event stream they read is not: OBS cannot present a credential, and an overlay that asked for one would show a password box on stream. That stream carries chat, gifts and viewer counts, and nothing that can change anything.