1. Your backend mints a session for the signed-in agent: POST /v1/web-sessions → a token (5 minutes to 12 hours). Revoke it with DELETE /v1/web-sessions/{id}.
  2. Hand the token to the agent’s browser. The @mergenlab/voice-web SDK does the rest: connects, places and ends calls, saves dispositions.
  • Web calls are human calls (human.agent_channel: "web"): same hours, recording, GET /v1/calls and webhooks.
  • Keep the token in page memory. Never ship your API key to the browser.