Authenticate T5 and T6 telemetry over HTTPS

README.md

@@ -88,6 +88,37 @@ and telemetry still work. Open `.help` during a record page and check that the
 record resumes afterwards without overlapping it. Runtime linking and client
 readiness require Plutonium.
 
+## Telemetry authentication (T5 and T6)
+
+Both reporters default to `https://ec.thewrightserver.net/api/telemetry` and send
+`Authorization: Bearer <token>` plus `Content-Type: application/json` on every
+POST. Existing event fields and queue behavior are unchanged. An explicit
+`tws_telemetry_url` override must also use HTTPS; remove any old HTTP override.
+
+Before upgrading the API or loading these reporters:
+
+1. Set the Electric Cherry service's **environment variable**
+   `EC_TELEMETRY_TOKEN` to a separate shared secret of at least 32 characters.
+   A missing service token disables ingestion.
+2. Both telemetry scripts embed the matching reporter secret in
+   `level.telemetry_token`. No game-server token dvar or private config is needed.
+3. Keep `tws_server_id` set to the exact registered server name, then restart
+   the map. Both reporters refuse to start with a short embedded token or a
+   non-HTTPS URL. Rotating the service token requires editing the token in both
+   scripts, deploying them to every game server, and restarting the maps.
+
+The API also accepts `X-EC-Telemetry-Token`; these reporters use Bearer auth.
+Cookies, query parameters, and JSON fields cannot authenticate telemetry.
+Missing or incorrect request tokens are rejected before payload parsing or
+recording. Reporters that cannot set headers need a trusted relay with an HTTPS
+reporter-facing endpoint. The plugins used here accept a headers array.
+
+After deployment, verify all four event types reach Electric Cherry. On a test
+server, also verify that a short embedded token and an HTTP URL prevent startup,
+that a wrong token is rejected without recording an event, and that deploying
+the correct token restores ingestion. Plugin transport completion alone does
+not prove API acceptance; inspect the API response or ingestion records.
+
 ## Validating T6
 
 ```powershell