# WebSocket Authentication

> Send the API key during the WebSocket upgrade without exposing secrets.

Canonical: https://nolimitnodes.com/docs/guides/websocket-authentication

The NoLimitNodes WebSocket endpoint reads `x-api-key` from the opening HTTP upgrade request.

## Node.js

The `ws` package supports custom headers.

```bash
npm install ws
```

```javascript

const socket = new WebSocket("wss://ws.nln.clr3.org", {
  headers: {
    "x-api-key": process.env.NLN_API_KEY,
  },
})

socket.on("open", () => {
  socket.send(JSON.stringify({
    jsonrpc: "2.0",
    id: "logs",
    method: "logsSubscribe",
    params: ["all", { commitment: "confirmed" }],
  }))
})

socket.on("message", (data) => {
  console.log(JSON.parse(data.toString()))
})
```

## Browser apps

The browser `WebSocket` API does not accept custom headers.

Use a backend relay:

1. Your browser opens an authenticated connection to your backend.
2. Your backend opens the NoLimitNodes connection with `x-api-key`.
3. Your backend forwards only the events needed by the signed-in user.

Keep these controls on the relay:

- User authentication
- Per-user subscription limits
- Allowed method list
- Allowed account and program list
- Message size limits
- Idle connection cleanup

> Warning: Never place your NoLimitNodes API key in browser JavaScript, a URL, or a query string.

## Terminal tools

```bash
wscat \
  -c wss://ws.nln.clr3.org \
  -H "x-api-key: YOUR_API_KEY"
```