diff --git a/facefusion/apis/core.py b/facefusion/apis/core.py
index 59ce74fa..71faab88 100644
--- a/facefusion/apis/core.py
+++ b/facefusion/apis/core.py
@@ -50,7 +50,7 @@ def create_api() -> Starlette:
 			Route('/assets', delete_assets, methods = [ 'DELETE' ], middleware = [ session_guard ]),
 			Route('/capabilities', get_capabilities, methods = [ 'GET' ]),
 			Route('/metrics', get_metrics, methods = [ 'GET' ], middleware = [ session_guard ]),
-			Route('/stream', post_stream, methods = [ 'POST' ]),
+			Route('/stream', post_stream, methods = [ 'POST' ], middleware = [ session_guard ]),
 			WebSocketRoute('/metrics', websocket_metrics, middleware = [ session_guard ]),
 			WebSocketRoute('/ping', websocket_ping, middleware = [ session_guard ]),
 			WebSocketRoute('/stream', websocket_stream, middleware = [ session_guard ])
diff --git a/facefusion/apis/endpoints/stream.py b/facefusion/apis/endpoints/stream.py
index 21475f23..bd1b3bd2 100644
--- a/facefusion/apis/endpoints/stream.py
+++ b/facefusion/apis/endpoints/stream.py
@@ -193,7 +193,7 @@ async def handle_video_stream(websocket : WebSocket, session_id : str) -> None:
 			message = await websocket.receive()
 
 			if not ready_sent and ready_event.is_set():
-				await websocket.send_text('ready:' + session_id)
+				await websocket.send_text('ready')
 				ready_sent = True
 
 			if message.get('bytes'):
@@ -221,7 +221,8 @@ async def handle_video_stream(websocket : WebSocket, session_id : str) -> None:
 async def post_stream(request : Request) -> Response:
 	from facefusion import rtc
 
-	session_id = request.query_params.get('session_id')
+	access_token = extract_access_token(request.scope)
+	session_id = session_manager.find_session_id(access_token)
 	stream_path = 'stream/' + session_id
 	body = await request.body()
 	sdp_offer = body.decode('utf-8')
diff --git a/test_stream.html b/test_stream.html
index 8a4f942a..8490d6e1 100644
--- a/test_stream.html
+++ b/test_stream.html
@@ -778,7 +778,7 @@ async function connectWhep(url) {
 
   var res = await fetch(url, {
     method: 'POST',
-    headers: { 'Content-Type': 'application/sdp' },
+    headers: { ...authHeaders(), 'Content-Type': 'application/sdp' },
     body: offer.sdp
   });
   log('WHEP response: ' + res.status + ' (' + Math.round(performance.now() - t0) + 'ms)', res.ok ? 'debug' : 'error');
@@ -880,9 +880,8 @@ async function connect() {
   var streamStarted = false;
 
   ws.onmessage = function(event) {
-    if (typeof event.data === 'string' && event.data.startsWith('ready:') && !whepUrlFromServer) {
-      var sessionId = event.data.split(':')[1];
-      whepUrlFromServer = base() + '/stream?session_id=' + sessionId;
+    if (typeof event.data === 'string' && event.data === 'ready' && !whepUrlFromServer) {
+      whepUrlFromServer = base() + '/stream';
 
       if (!streamStarted) {
         streamStarted = true;