App-events
Every user event of the connection’s app, for backends. Requires an x-app-api-key issued for this app on the handshake. Send { action: "subscribe", channel: "app-events", resumeFrom? }. Frames match the user-event channel, always carry userId, and are stamped with the app stream’s eventId.
App-level auth: pass appId as a query parameter on connect. Required for all connections. Browsers are admitted by an Origin on the app's allowed origins; servers by the apiKey scheme instead.
Optional server-to-server auth on the handshake; any supplied key must be valid and replaces the Origin check. Without a key, an allowed Origin is required even when the app has requireApiKey for REST. WebSocket key enforcement is currently deferred. Needed for the app-events channel. Never send from a browser.
User-level auth: send { action: 'authenticate', token } after connected (a token query param still works but is deprecated). Required for user-specific events (orders, balances). Same JWT as the REST API.