Needs Camera read access, plus Live and Historical streaming permissions on the key itself — the streaming token inherits its scope from the key.

Cameras publish HEVC, which most desktop Chrome and Firefox builds won't decode. If you get audio-free black panels, switch to H.264.