Authentication - Tradara

/v1/ws requires a user JWT session that the API gateway validates before upgrading the connection. There is no API key path on this endpoint.

Firm API keys (tdr_live_…) are denied on /v1/ws. Prop firms monitoring traders should use /v1/firm-ws, which supports both firm API keys and staff JWT sessions.

Modes

Mode	How
Browser (terminal)	Session cookie from `POST /v1/auth/login` sent automatically on the upgrade request.
Custom app	`Authorization: Bearer <access_token>` header on the upgrade request.
WebSocket subprotocol	`Sec-WebSocket-Protocol: bearer, <access_token>` — the pattern the Tradara terminal uses.

The gateway resolves the session, injects X-User-ID upstream, and forwards the upgrade to ws-server. Clients never send X-User-ID themselves.

Subprotocol example (browser `WebSocket`)

Most browser WebSocket constructors do not let you set arbitrary headers. Use the subprotocol form instead:

const ws = new WebSocket(
  "wss://api.tradara.com/v1/ws",
  ["bearer", accessToken],
);

Header example (Node, server-side)

import WebSocket from "ws";

const ws = new WebSocket("wss://api.tradara.com/v1/ws", {
  headers: { Authorization: `Bearer ${accessToken}` },
});

What you can reach

Once upgraded, you receive every event scoped to your user across all accounts you own. There is no scope.set, no X-Firm-ID, and no per-account subscription — see Overview.

What fails

Symptom	Cause
HTTP `401` on the upgrade	Missing or invalid JWT / expired session cookie. Refresh the session via `/v1/auth/*` before reconnecting.
HTTP `403` on the upgrade	Credentials presented a firm API key, not a user JWT. Use `/v1/firm-ws`.
Connection closed immediately after upgrade	Session was valid at upgrade time but the underlying user was revoked or suspended. Re-authenticate.