Authentication
Authentication is only needed for your own order, trade and balance events. Every public message works on an anonymous connection.
This endpoint requires the WebSocket API key permission - see API Access Permissions.
HMAC login
Send message type 114 after the socket opens:
[114, {
"type": 114,
"publicKey": "YOUR_API_PUBLIC_KEY",
"timestamp": 1735866257711,
"nonce": 5000,
"signature": "COMPUTED_SIGNATURE"
}]
| Field | Type | Description |
|---|---|---|
| publicKey | string | API public key - the same value you send as X-PCK over REST. |
| timestamp | integer | Current time in milliseconds (UTC), as X-Stamp over REST. |
| nonce | integer | Optional. Backward tolerance for timestamp in milliseconds, as X-Nonce over REST. Omitted, 0 or negative means 5000; values above 60000 are capped at 60000. |
| signature | string | HMAC-SHA256 signature. |
The signature is computed exactly as for the REST API - the WebSocket service and the REST API hand the same four values to the same validator. See Authentication V1 for the algorithm and worked examples.
Login result
[114, { "type": 114, "ok": true, "id": 12345, "message": null }]
| Field | Description |
|---|---|
ok | true when the key validated. |
id | Your user id; 0 when ok is false. |
message | Failure reason; null on success. |
The reply carries type 114, the same type as the request - not 115. A client waiting for
[115, ...] will wait forever.
A second login attempt on an already-authenticated connection is ignored silently. To switch API keys, open a new connection.
After a successful login, your order, trade and balance events are sent on the same connection automatically; you do not subscribe to them. See private messages.