Authentication

Every call carries your workspace's key as a bearer token:

curl https://api.pipsocket.com/v1/accounts/acc_01m6tx3k9f2qw8r7bznd5yvh4c \
  -H "Authorization: Bearer $PIPSOCKET_KEY"

One key per workspaceCopy Anchor Link

• A workspace has one key, and it works for every account in the workspace. An account in another workspace answers 404 no_such_account, exactly as an account that doesn't exist.
• The key is psk_ and 43 more characters. It is shown once, when it is made: Pipsocket keeps only its hash and its last four characters.
• Make it on the dashboard's API key page. The workspace's owners and admins can make and roll it; members see its last four characters, who made it and when.
• Keep it on your server. The API doesn't answer browsers' cross-origin requests, so a key in a web page wouldn't work anyway.
• A new key works within about a minute, as it reaches every Cloudflare location.
• The key is checked on every REST call, and on a stream once, when it connects.

Rolling the keyCopy Anchor Link

Rolling gives the workspace a new key and retires the current one. On the API key page, choose Roll key and confirm; the new key is shown once, and the dialog stays open until you tick that you've saved it.

The old key stops working for new requests and new streams within about a minute, so put the new key everywhere the old one was used straight away. If Pipsocket can't retire the old key at once, the page says so and keeps trying every minute: until then the old key may still work.

A stream checks the key only when it connects. A stream opened with the old key stays open, and its calls still work, until it closes. After rolling a key you suspect someone else has, close your own streams and connect them again with the new key; a stream someone else opened stays open until it closes, so engage the kill switch if they could trade, and contact support.

RefusalsCopy Anchor Link

The stream takes the key the same way, on its WebSocket upgrade: see the WebSocket stream.