Broker WebSocket authentication

Public market-data channels do not require authentication. To subscribe to a private channel, use the broker_api_key method and include the user’s wallet address in auth.wallet_address. The wallet must belong to your Broker.

Sign a private subscription

The request field t is a Unix timestamp in milliseconds. Use floor(t / 1000) as the time value in the signature string. URL-encode the wallet address and keep this field order:

channel=ec.orders&event=subscribe&time=<Unix seconds>&wallet_address=<URL-encoded wallet address>

Compute HexEncode(HMAC_SHA512(Broker API Secret, UTF8(signature string))). The WebSocket signature includes the wallet address and differs from the REST signature. Never send your API Secret.

{
  "t": 1720000000123,
  "id": "broker-private-1",
  "op": "subscribe",
  "ch": "ec.orders",
  "payload": {"all": true},
  "auth": {
    "method": "broker_api_key",
    "key": "YOUR_BROKER_API_KEY",
    "sign": "HEX_SIGNATURE",
    "wallet_address": "<USER_WALLET>"
  }
}

For this example, time in the signature string is 1720000000. Sign each private channel with its own channel name. The wallet address in the signature must match auth.wallet_address exactly.

Authenticate a connection first (optional)

You can authenticate with server.sign before subscribing. Sign this separate string:

channel=server.sign&event=auth&time=1720000000&wallet_address=<URL-encoded wallet address>

{
  "t": 1720000000123,
  "id": "broker-auth-1",
  "op": "auth",
  "ch": "server.sign",
  "payload": {
    "method": "broker_api_key",
    "key": "YOUR_BROKER_API_KEY",
    "sign": "HEX_SIGNATURE",
    "wallet_address": "<USER_WALLET>"
  }
}

After successful connection authentication, subsequent private subscriptions and unsubscriptions can omit auth. A connection is bound to one user wallet. Open a new connection to switch users, and authenticate again after reconnecting. Pass the wallet in the WebSocket message; the REST X-User-Wallet-Address header is not required on the WebSocket handshake. For REST signing, see Broker API Key and signing.

​Sign a private subscription

​Subscribe

​Authenticate a connection first (optional)

Sign a private subscription

Subscribe

Authenticate a connection first (optional)