diff --git a/README.md b/README.md
index 54f45d41..51c289d6 100644
--- a/README.md
+++ b/README.md
@@ -74,7 +74,7 @@ The script must be executed via `sudo` from the user that owns the repo. It will
 - run `npm install --production`
 - copy `config.example.yaml` to `config.yaml` if needed (edit the file afterwards for admins + `media.whepBaseUrl`)
 - download mediaMTX v1.15.3 and drop it into `/usr/local/bin`
-- write `/etc/mediamtx/mediamtx.yml` from `server/mediamtx/mediamtx.yml` (SRT ingest on :9000, wildcard `rover-*` paths, auth webhook at `/mediamtx/auth`)
+- write `/etc/mediamtx/mediamtx.yml` from `server/mediamtx/mediamtx.yml` (SRT ingest on :9000, open ingest, viewer auth webhook at `/mediamtx/auth`)
 - create + enable `mediamtx.service` and `multirover.service`, both running as your repo user and pointing at the clone directly
 
 Publishing rovers lives on a trusted network, so the shipped config (tracked at `server/mediamtx/mediamtx.yml`) skips HTTP auth for SRT ingest and whitelists any path that matches `rover-*`. The installer overwrites `/etc/mediamtx/mediamtx.yml` every time you run it—if you need to tweak ports or add TURN servers, edit the template in the repo and rerun `install_server.sh` so every box stays in sync automatically.
@@ -83,5 +83,5 @@ Once finished, update `server/config.yaml` with your admin passwords and `media.
 
 ### Video handshake + diagnostics
 
-- Every `video:request` returns `{ url, token }`. The browser posts the SDP offer to `url` and includes `Authorization: Bearer <token>`. mediaMTX forwards the token to `/mediamtx/auth`, which checks the socket’s permissions and either returns 200 or 401—no query parameters are involved anymore.
+- Every `video:request` returns `{ url, token }`. The browser posts the SDP offer to `url` and includes `Authorization: Basic base64(token:token)`. mediaMTX forwards the username (`token`) to `/mediamtx/auth`, which checks the socket’s permissions (driver assignment, admin/spectator role, lockdown state) and either returns 200 or 401—no query parameters are involved anymore.
 - To see what mediaMTX is ingesting from the Pis, run `npm run check:media` (or `node scripts/checkMedia.js`). It hits `/v3/paths/list` and prints each rover’s `ready` state and byte counters so you can instantly spot publish issues.
diff --git a/new_video_pipeline.md b/new_video_pipeline.md
index f25859fa..51662e26 100644
--- a/new_video_pipeline.md
+++ b/new_video_pipeline.md
@@ -24,7 +24,7 @@
 3. **Web clients**
    - Tiny helper (React hook or vanilla class) that:
      1. Requests a viewer JWT for rover `<id>`.
-     2. Issues a `POST` to `/whep/rover-<id>` with `Authorization: Bearer <JWT>`.
+     2. Issues a `POST` to `/whep/rover-<id>` with `Authorization: Basic base64(token:token)` (token issued by the server when the client calls `video:request`).
      3. Maintains auto-reconnect timers on ICE failure so dashboard widgets can come/go without reloading the page.
    - Operator dashboard mounts one player tied to the assigned rover. The spectator view instantiates one player per tile, muting + pausing hidden elements to keep CPU usage sane even when every rover is shown simultaneously.
 
diff --git a/server/mediamtx/mediamtx.yml b/server/mediamtx/mediamtx.yml
index b16cfef8..8faf0ca1 100644
--- a/server/mediamtx/mediamtx.yml
+++ b/server/mediamtx/mediamtx.yml
@@ -21,13 +21,13 @@ webrtcICEServers2: []
 srt: yes
 srtAddress: :9000
 
-# authMethod: http
-# authHTTPAddress: http://127.0.0.1:8080/mediamtx/auth
-# authHTTPExclude:
-#   - action: publish
-#   - action: api
-#   - action: metrics
-#   - action: pprof
+authMethod: http
+authHTTPAddress: http://127.0.0.1:8080/mediamtx/auth
+authHTTPExclude:
+  - action: publish
+  - action: api
+  - action: metrics
+  - action: pprof
 
 paths:
   all: