WebSocket Realtime Protocol & First-Frame Auth
Authenticating WebSocket connections without URL query tokens and handling real-time events.
First-Frame Authentication Handshake
To prevent access tokens from appearing in proxy or web server access logs, clients connect to wss://<host>/ws without query parameters and send an auth frame within 5 seconds of opening the socket:
Client-to-Server First Frame & Server Handshake Response
// 1. Client sends first frame immediately after connection open:
{ "t": "auth", "token": "<access_token>" }
// 2. Server verifies token and replies:
{
"t": "hello",
"authenticated": true,
"user_id": 101,
"online_ids": [102, 105],
"active_call": null,
"ts": 1793939450000
}