Websocket Authentication

Login and Private Channel Authentication

Private channels require a login message containing the API key, passphrase, timestamp, and HMAC signature. After a successful login response, the client can subscribe to private account-level channels.

Authentication flow:

Establish connection
Send login request
Wait for response
Subscribe to private channels

Login Request

{
  "op": "login",
  "args": [
    {
      "apiKey": "YOUR_API_KEY",
      "passphrase": "YOUR_PASSPHRASE",
      "timestamp": "1766124407915",
      "sign": "BASE64_ENCODED_SIGNATURE"
    }
  ]
}

Request Parameters

Parameter	Type	Description
`apiKey`	String	API Key
`passphrase`	String	API passphrase
`timestamp`	String	Current timestamp, in milliseconds
`sign`	String	Signature, Base64 encoded

Signature Generation

Signature string: timestamp + "GET" + "/user/verify" + ""

Use secretKey to perform HMAC SHA256 encryption on the signature string.
Base64 encode the result.

JavaScript Example

const crypto = require('crypto');function generateSign(timestamp, secretKey) {const message = timestamp + 'GET' + '/user/verify' + '';return crypto.createHmac('sha256', secretKey).update(message).digest('base64');}

Python Example

import hmac, base64

def generate_sign(timestamp, secret_key):
    message = timestamp + 'GET' + '/user/verify' + ''
    signature = hmac.new(bytes(secret_key, 'utf8'), bytes(message, 'utf-8'), digestmod='sha256').digest()return base64.b64encode(signature).decode()

Login Response

{"event": "login","code": "0"}

Error Codes

Error Code	Description
30001	Channel does not exist
30002	Invalid request
30003	Invalid `op`
30004	User login required
30005	Login failed
30011	Invalid `ACCESS_KEY`
30012	Invalid `ACCESS_PASSPHRASE`
30013	Invalid `ACCESS_TIMESTAMP`
30014	Request timestamp expired
30015	Invalid signature
30016	Parameter error