Settings

Configure server connection, API keys, and test defaults

WebSocket Server

Main WebSocket endpoint. For production: wss://ws.gnotus.com/ws

REST API base URL (same host, no /ws path). Used for publish, rooms, stats, token verify.

Server-to-server API key (X-API-Key header). Configured via API_KEYS env var on the server.

Tenant Configuration

Channels are namespaced as org_id:app_id:kind:name.

A token for app A can never access app B's channels.

JWT Token

Ed25519 JWT signed by your app backend. Claims: sub, org, app, scope, role, exp, jti.

Token Claims Example
{
  "sub": "user-or-device-uuid",
  "org": "00000000-0000-0000-0000-000000000001",
  "app": "test-app",
  "scope": ["sub:room:*", "pub:room:*", "pub:ingest:*", "sub:user:self"],
  "role": "user",
  "exp": 1700000000,
  "jti": "unique-token-id"
}
Role Types
useranonworkerbackend
Security Notes

Auth: JWT signed Ed25519. Verified once at connect time. Tokens are minted by app backends, never by the socket server.

Scopes: (sub|pub):{kind}:{glob}. Checked at subscribe and publish time. sub:user:self expands to the connection's own user channel.

REST API: X-API-Key header, per-org keys with optional app_id filter. Constant-time comparison.

Rate limits: Per-connection token bucket (30 msg/s, burst 60). Per-org Redis-backed sliding window.

Origin: Browser connections checked against allowlist. Worker/backend connections skip origin check.