Skip to main content
WSS
appId
type:userPassword

App-level auth: pass appId as a query parameter on connect. Required for all connections. Browsers are admitted by an Origin on the app's allowed origins; servers by the apiKey scheme instead.

x-app-api-key
type:httpApiKey

Optional server-to-server auth on the handshake; any supplied key must be valid and replaces the Origin check. Without a key, an allowed Origin is required even when the app has requireApiKey for REST. WebSocket key enforcement is currently deferred. Needed for the app-events channel. Never send from a browser.

jwt
type:http

User-level auth: send { action: 'authenticate', token } after connected (a token query param still works but is deprecated). Required for user-specific events (orders, balances). Same JWT as the REST API.

Catalog change
type:object

One event or market's current state. op is created, updated or deleted; deletes carry only the id. Same item shape as GET /catalog/changes.

Subscribe to catalog changes
type:object

Subscribe (or unsubscribe) to new, changed and deleted events and markets