Yes, the connect token is transmitted from web backend to client over HTTPS.

This token contains public and private data. The public data tells the client which servers to connect to, what the keys are etc, hence the need for HTTPS.

The private data is what gets sent over UDP in connection handshake, and is encrypted with a libsodium AEAD primitive using a private key shared between the backend matchmaker and the dedicated server instances.

Because of this clients cannot read, modify or forge the connect token private data, so cannot connect unless they get a token from the backend.

Tokens are only valid for a specific authenticated client to connect to a small set of n dedicated servers, and expire quickly (30-45 seconds).