Docs/Channels
Private Channels
Authorized channel specification, wire handshake, and HMAC token verification.
Specification
Private channels restrict access to authorized connections. Every private channel name must begin with the private- prefix (e.g. private-user-42).
Clients must supply an HMAC-SHA256 authorization token signed by your application backend to complete subscription.
Protocol Handshake Flow
| Step | Initiator | Action / Frame | Payload |
|---|---|---|---|
| 1. Connect | Server | pusher:connection_established | Socket receives unique socket_id. |
| 2. Auth Request | Client | HTTP POST /broadcasting/auth | Client sends { socket_id, channel_name } to backend. |
| 3. Sign | Backend | HTTP 200 OK | Backend returns { "auth": "<app_key>:<signature>" }. |
| 4. Subscribe | Client | Wire pusher:subscribe | Client transmits auth token over WebSocket. |
| 5. Verify | Server | Wire pusher_internal:subscription_succeeded | Server verifies signature and grants channel membership. |
If the signature fails verification, the server rejects subscription with wire event pusher:error (code 4009).
Authorization Token Specification
The backend computes an HMAC-SHA256 hash using your application secret:
plaintext
String to sign: ${socket_id}:${channel_name}
Signature: HMAC-SHA256(secret, string_to_sign)
Payload: { "auth": "${app_key}:${signature}" }For complete signature specifications across languages, see Auth & Signatures.
Wire Protocol Frame
json
{
"event": "pusher:subscribe",
"data": {
"channel": "private-user-42",
"auth": "your_app_key:4a7e9b2c8f..."
}
}Client SDK Reference
ts
import Pusher from 'pusher-js'
const pusher = new Pusher('YOUR_APP_KEY', {
wsHost: 'wss.socketo.dev',
wssPort: 443,
forceTLS: true,
cluster: 'socketo',
channelAuthorization: {
endpoint: '/api/broadcasting/auth',
transport: 'ajax',
},
})
const channel = pusher.subscribe('private-orders')
channel.bind('order-updated', (order: { status: string }) => {
console.log('Order status:', order.status)
})
channel.bind('pusher:subscription_error', (status: { error: string }) => {
console.error('Authorization failed:', status)
})