Authentication

Authentication is required only for the private WebSocket endpoint. Ekiden supports two authentication methods:

JWT Access Token — recommended for authenticated user sessions.
API Key — recommended for server-side applications, trading bots, and automated integrations.

JWT Authentication

Authenticate by sending an Auth message.

Field	Value
`op`	`auth`
`bearer`	Your JWT access token
`req_id`	Optional correlation identifier

{
  "op": "auth",
  "bearer": "<token>",
  "req_id": "1"
}

See the Auth message in the Private WebSocket Reference for the complete request and response schema.

Unlike the REST API, WebSocket API key authentication uses a dedicated signing payload. Signing payload

EKIDEN_WS|AUTH|{timestamp_ms}|{nonce}

Step	Description
1	Generate `timestamp_ms` (Unix time in milliseconds) and a unique `nonce`.
2	Generate an Ed25519 signature using your API private key.
3	Send an `auth_api_key` message to the private WebSocket (`/ws/private`).

{
  "op": "auth_api_key",
  "api_key": "0x...",
  "signature": "0x...",
  "timestamp_ms": 1700000000000,
  "nonce": "unique-nonce",
  "req_id": "1"
}

Rule	Description
Clock skew	±30 seconds from server time
Nonce	Must be unique per API key
Scopes	The API key must allow access to the requested private topics

See the AuthApiKey message in the Private WebSocket Reference for the complete request format and response schema.