Authentication

Authenticate before streaming

Requests that touch private data—positions, orders, balances, and every create or cancel method—must present a valid API key (JWT bearer token). The WebSocket flow mirrors the REST API: connect a wallet, sign the authentication challenge, then reuse the issued API key for every session until it is revoked.

Generate or rotate credentials

Use the manager below to connect your wallet, issue a key, and copy it securely. Revoking the key disconnects the wallet and invalidates all active sessions.

Send the auth request

After the key is available:

1. Open a WebSocket connection to the matcher.
2. Call the auth operation with the API key in the payload.
3. Wait for an authResponse confirmation before subscribing to protected streams.

Re-authenticate whenever the key rotates or the server rejects an operation with an authentication error.