> For the complete documentation index, see [llms.txt](https://docs.niza.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.niza.io/websocket-api-1.0/websocket-authentication.md).

# WebSocket Authentication

\
To listen to private channels an authorization token is required. This is accomplished by making an HTTP request to the [Channel Authorization Endpoint](#channel-authorization-endpoint). The authorization token received should be set in the payload of the subscribe message.

### Pusher Channel Authorization

If  you are using Pusher client the authorization endpoint should be set when initializing Pusher instance, read more about setting the authorization endpoint [here](https://pusher.com/docs/channels/server_api/authorizing-users/#client-side-setting-the-authorization-endpoint).

Example of initialization of the Pusher with `channelAuthorization`

```javascript
var pusher = new Pusher("APP_KEY", {
      cluster: "eu",
      forceTLS: true,
      disableStats: true,
      enabledTransports: ["wss", "ws"],
      activityTimeout: 10000,
      channelAuthorization: {
        endpoint: `https://app.niza.io/trade/v1/broadcasting/auth`,
        transport: "ajax",
        headers: {
          "X-API-Key": "[API_KEY]",
          "X-API-Sign": "[GENERATED_SIGNATURE]",
          "Access-Control-Allow-Origin": "*",
        },
      },
    });

```

## Channel Authorization Endpoint

<mark style="color:green;">`POST`</mark> `/broadcasting/auth`

Authorize channel subscription. Request should be made to the general [Request URL](/general.md).

**Headers**

| Name         | Value                                                                    |
| ------------ | ------------------------------------------------------------------------ |
| Content-Type | `application/json`                                                       |
| X-API-Key    | API Key                                                                  |
| X-API-Sign   | The generated signature, check api [authentication](/authentication.md). |

**Body**

| Name           | Type   | Description                                     |
| -------------- | ------ | ----------------------------------------------- |
| `socket_id`    | number | The id of the currently connected WebSocket.    |
| `channel_name` | string | The private channel name you want to subscribe. |

**Response**

{% tabs %}
{% tab title="200" %}

```json
{
    "auth": "23d6f445cd259b91adf9:c35ecc2c7a8280911ff4b4818be21ee80ae9b3843f8db60d422a3f5824474ac4"
}
```

{% endtab %}

{% tab title="400" %}

```json
{
  "error": "Invalid request"
}
```

{% endtab %}

{% tab title="403" %}

```json
{
    "error": "Access Denied"
}
```

{% endtab %}
{% endtabs %}