{
"type": "connected",
"appId": "app_demo123",
"userId": "usr_xyz789",
"protocolVersion": 0,
"auth": "browser"
}{
"type": "authenticated",
"userId": "usr_xyz789",
"expiresAt": 0,
"id": "string"
}{
"type": "heartbeat",
"ts": 1710000000000
}{
"action": "authenticate",
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"resumeFrom": "string",
"id": "string"
}Auth
Authenticate mid-session to receive user-specific events. Send your JWT token (same as REST API) to upgrade from app-level to user-level auth. Supports re-authentication for token refresh or user switch. Pass resumeFrom (the last eventId processed) to replay user events missed while disconnected; a resumed frame ends the replay. auth_expiring warns before the token expires; auth_expired means the session dropped to app level.
Connect-time auth (deprecated): ?token=eyJ... as a query param alongside appId.
{
"type": "connected",
"appId": "app_demo123",
"userId": "usr_xyz789",
"protocolVersion": 0,
"auth": "browser"
}{
"type": "authenticated",
"userId": "usr_xyz789",
"expiresAt": 0,
"id": "string"
}{
"type": "heartbeat",
"ts": 1710000000000
}{
"action": "authenticate",
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"resumeFrom": "string",
"id": "string"
}App-level auth: pass appId as a query parameter on connect. Required for all connections. Browsers are admitted by an Origin on the app's allowed origins; servers by the apiKey scheme instead.
Optional server-to-server auth on the handshake; any supplied key must be valid and replaces the Origin check. Without a key, an allowed Origin is required even when the app has requireApiKey for REST. WebSocket key enforcement is currently deferred. Needed for the app-events channel and for the firehose channel on the orderbook socket. Never send from a browser.
User-level auth: send { action: 'authenticate', token } after connected (a token query param still works but is deprecated). Required for user-specific events (orders, balances). Same JWT as the REST API.
Sent immediately after successful connection. Includes userId if JWT was provided on connect.
Confirms successful mid-session authentication
Application-level heartbeat event for connection liveness
Upgrade connection to user-level auth. Uses the same JWT as the REST API. Supports re-authentication for token refresh or user switch.