Flussonic

Token Streams can be sniff?

How can someone take the stream when auth enabled?

if you do it properly — no

Yes it is possible. Unless you use DRM the content is not encrypted. Anyone with the right tools can download it to a file.