Private Channels#

Private channels require server-side authentication before a client can subscribe. This ensures only authorized users receive sensitive data. Channel names must start with private-.

In Socketo Cloud, use your application key wherever these examples refer to APP_KEY.

How It Works#

When a client subscribes to a private channel, the Pusher SDK automatically sends an auth request to your authEndpoint. Your server validates the user and returns a signed response.

Auth Flow#

1. Client calls pusher.subscribe('private-channel')
2. SDK sends auth request to your authEndpoint with socket_id and channel_name
3. Your server validates the user session
4. Your server returns { auth: "APP_KEY:SIGNATURE" }
5. SDK completes the subscription

Auth Response#

{
  "auth": "APP_KEY:HMAC_SIGNATURE"
}

Generating the Signature#

The signature is an HMAC-SHA256 hash of SOCKET_ID:CHANNEL_NAME using your App Secret.

import crypto from 'node:crypto'

function generateAuth(socketId, channelName, appKey, appSecret) {
  const stringToSign = `${socketId}:${channelName}`
  const signature = crypto
    .createHmac('sha256', appSecret)
    .update(stringToSign)
    .digest('hex')

  return { auth: `${appKey}:${signature}` }
}

See Auth & Signature for the full guide.

Security Notes#

• Never expose your App Secret in client-side code
• Always verify the socket_id belongs to the authenticated user
• Return 403 Forbidden if the user is not authorized