Authentication

Every WebSocket connection is authenticated via an API key sent in the first JSON message.

First-message handshake

The very first message you send on a new connection must be a compile.start message containing your API key in the api_key field:

{
  "type": "compile.start",
  "api_key": "pk_live_...",
  "entry": "src/main.ts",
  "release": true
}

If the key is valid, the server proceeds without sending an explicit acknowledgement — you will receive compile.queued when the job is enqueued.

If the key is invalid, missing, or the first message is not compile.start, the server sends an auth.error message and closes the connection.

auth.error message

{
  "type": "auth.error",
  "message": "human-readable description",
  "code": "INVALID_KEY"
}

Code	Cause
MISSING_KEY	api_key field was absent from the first message
INVALID_KEY	Key does not exist in the system
KEY_EXPIRED	Key has passed its configured expiry date
KEY_REVOKED	Key was manually revoked

Key format

Pure API keys start with pk_live_ for production keys and pk_test_ for test keys (test keys are for internal use). The full value is 40–60 characters.

Security

• Send the API key only in the first compile.start message. Do not include it in subsequent messages on the same connection.
• Never log the compile.start message — it contains the raw key.
• Use environment variables or a secrets manager to store keys. Do not hardcode them.
• See API Keys for key rotation and revocation.