Yeah as I understand it, most things heavily using the IGB right now are the tools that rely on it being open when changing systems. These tools will lose a lot of functionality once the IGB is taken out back and double tapped in the head.

These aren't shown in the metrics you've given.

Its chromium, but heavily modified (igb js callbacks, custom headers and other) thats the main problem

and where is that going to be then? CREST?

Currently i am working on a tracking tool, so when i jump from system to system it will tell me the info i need to know about that System (sometimes even before i finish the jump since the headers will sometimes update fast).
When you move this to CREST we will have to do a lot off calls to the server to keep track off where the player is.
This means a lot off calls to a server what is not necessary to do.. (so more stress on the server to).
And since it will have a cache timer... it wont be accurate any more...

And then we have the removal off the JavaScript functions...

I can see this work whit CREST.. we just send the correct information to it and it will pop up a window in the players screen.
but whit that you probably gone have to have a API key.. otherwise you will a lot off random screens pop up everywhere..
and whit that you also have the problem.. you gone need the API key.. before you didn't need that.. only to be trusted.

Hmm.. Didn't think about that yet... could work to indeed.
but then again the multiple clients on one system..

then you would need the api off the player.. if not you can track any one you want... or you can make a application that can spam any one you want whit lets say fitting windows.. imagine that in a combat situation..
and whit the igb you don't need the api to get the location off the player you just read out the header

Does the token expire when the players logs out using SSO?, or do you give the application access to the current header information until you actively revoke them?

For all the flaws the IGB has, at least it easy to understand when you are submitting the headers and when you are not, at least from the browser open or closed perspective.