Authentication

The streaming client authenticates with the same signing key as the REST client. There is no separate stream credential: pass the keyId and privateKeyHex you use for REST calls, and createStreamClient signs the WebSocket handshake for you.

import { createStreamClient } from "@parlayx/sdk/stream";

const stream = createStreamClient({
  keyId: process.env.PARLAYX_KEY_ID!,
  privateKeyHex: process.env.PARLAYX_PRIVATE_KEY_HEX!,
});

The signature is carried in the upgrade URL’s query string, because a WebSocket upgrade has no header slot to put it in. Your private key never leaves the process: only the key id, a timestamp, and the signature go on the wire.

Run the streaming client on a server you control, never in a browser or other untrusted client. Signing needs your private key in the running process, so shipping it to end users would hand them your signing key. Signing the handshake uses node:crypto, so the client requires Node.js 20 or newer.

Because the signature covers the timestamp, it expires. The client signs a fresh handshake on every connect attempt, including reconnects, so a long-lived stream keeps working without you refreshing anything. For the wire-level handshake, see the WebSocket API’s Authentication.

TypeScript SDK

Streaming