DocsAuthentication

Authentication

Unlike REST, the public WebSocket does not read x-api-key headers on data frames. Authentication happens exactly once during the HTTP upgrade.

How it works

Pass your raw API key in the apiKey query parameter on the upgrade URL. The server validates it for the ws surface before completing the HTTP 101 handshake.

Connect URL
wss://stream.tickerlayer.com/?apiKey=<YOUR_API_KEY>

Try a live connection from the WebSocket overview without pasting your key into the page.

Case-sensitive parameter name

The query parameter must be exactly apiKey. Other spellings (e.g. api_key, APIKEY) are rejected with a 401 before the upgrade completes.

This is native WebSocket — there is no Socket.IO namespace, no separate handshake object, and no in-frame authentication step.

Compared to REST

  • REST — prefer the x-api-key header; the ?apiKey= query param is also supported for compatibility.
  • WebSocket — only ?apiKey= on the upgrade URL is supported. Headers on subsequent frames are not read.

Auth errors

  • 401 — invalid or missing apiKey, or key not entitled for WebSocket. The upgrade is rejected; no frames are sent.
  • 403 — key exists but the ws surface is not enabled for this account tier.