Documentation

<script src="https://webskts.com/resources/webskts_push_client.js"></script>
<script>
const client = new PushClient({
    host:    'wss://ws.webskts.com',
    guid:    'YOUR_GUID',
    channel: 'orders',
});
client
    .on('order-update', (data) => applyUpdate(data))   // replayed ones too, in order, once each
    .on('$resumed', ({ channel, count }) => console.log(`caught up on ${count} on ${channel}`))
    .on('$gap', async ({ channel }) => {
        // Some messages are gone (away too long, or more than 1,000 since):
        // what follows is complete, but what came before it is not.
        showOrders(await (await fetch('/orders/current')).json());
    });
client.connect();

// Joining a running session: replay everything still kept, from the start.
const live = new PushClient({ host: 'wss://ws.webskts.com', guid: 'YOUR_GUID', channel: 'quiz-7', since: 0 });
// Or on a client you already have:
const slides = client.subscribe('slides-42', { since: 0 });
</script>

// Keep the last id per channel and send it back when you reconnect.
let lastId = {};   // channel → id
function connect() {
    const resume = Object.entries(lastId).map(([ch, id]) => `${ch}:${id}`).join(',');
    const ws = new WebSocket(`wss://ws.webskts.com/ws/YOUR_GUID/orders` + (resume ? `?resume=${resume}` : ''));
    ws.onmessage = (event) => {
        if (event.data === 'pong') return;
        const msg = JSON.parse(event.data);
        if (msg.type === 'gap') {
            // Messages after msg.from and before msg.to are gone: refetch your state.
            refetchOrders();
        } else if (msg.type === 'message' && msg.id != null) {
            if (msg.id <= (lastId[msg.channel] ?? 0)) return;   // already seen
            lastId[msg.channel] = msg.id;
            applyUpdate(msg.data);
        }
    };
    // ...ping every 25 seconds and reconnect with a backoff, as in "Client examples".
}

<!-- Optional: a small client that reconnects, keeps the connection alive and
     replays messages missed while disconnected. Load it from us, or download
     it and serve it from your own site. -->
<script src="https://webskts.com/resources/webskts_push_client.js"></script>
<script>
const client = new PushClient({
    host:     'wss://ws.webskts.com',
    guid:     'YOUR_GUID',
    channels: ['notifications', 'alerts'],   // or: channel: 'notifications'
});
client
    .on('$ready', ({ channels }) => {
        console.log('Connected to:', channels);
    })
    .on('$rotated', () => {
        // Your connection id was rotated: fetch the new one and connect again.
    })
    .on('$suspended', () => {
        // The account is suspended: the client stops until you connect again.
    })
    .on('$gap', ({ channel }) => {
        // Away longer than your replay window: some messages are gone.
        // Fetch the current state from your own server.
    })
    .on('order-update', (data, raw) => {
        // raw.channel tells you which channel this came from
        console.log(`Order update on ${raw.channel}:`, data);
    })
    .on('*', (data, raw) => {
        // Catch-all for any event
        console.log(`[${raw.event}]`, data);
    });
client.connect();
</script>

// No library: the browser's own WebSocket.
const GUID = 'YOUR_GUID';
const CHANNELS = 'notifications';   // or 'notifications,alerts'
const URL = `wss://ws.webskts.com/ws/${GUID}/${CHANNELS}`;
let retries = 0;
let pinger;

function connect() {
    const ws = new WebSocket(URL);

    ws.onopen = () => {
        retries = 0;
        // The server closes a socket that sends nothing for 60 seconds.
        pinger = setInterval(() => ws.readyState === WebSocket.OPEN && ws.send('ping'), 25000);
    };
    ws.onmessage = (event) => {
        if (event.data === 'pong') return;   // the reply to our ping
        const msg = JSON.parse(event.data);
        if (msg.type === 'connected') {
            console.log('Ready on channels:', msg.channels);
        } else if (msg.type === 'message') {
            console.log(`[${msg.channel}] ${msg.event}:`, msg.data);
        }
    };
    ws.onclose = (e) => {
        clearInterval(pinger);
        // 4001: the connection id was rotated. 4003: the account is suspended.
        // Reconnecting with this id would be refused, so stop.
        if (e.code === 4001 || e.code === 4003) return;
        // Anything else (a deploy, a dropped network): try again, waiting
        // longer each time. Messages sent meanwhile are missed;
        // webskts_push_client.js replays them for you.
        const delay = Math.min(30000, 1000 * 2 ** retries++) + Math.random() * 1000;
        setTimeout(connect, delay);
    };
}
connect();

# pip install websocket-client
import websocket, json

GUID = 'YOUR_GUID'
CHANNEL = 'notifications'
URL = f'wss://ws.webskts.com/ws/{GUID}/{CHANNEL}'

def on_message(ws, message):
    msg = json.loads(message)
    if msg['type'] == 'connected':
        print(f"Ready on: {msg['channels']}")
    elif msg['type'] == 'message':
        print(f"[{msg['channel']}] {msg['event']}:", msg['data'])

def on_error(ws, error): print('Error:', error)
def on_close(ws, code, msg): print('Disconnected', code)
def on_open(ws): print('Connecting...')

ws = websocket.WebSocketApp(
    URL,
    on_message=on_message,
    on_error=on_error,
    on_close=on_close,
    on_open=on_open,
)
# ping_interval keeps the socket alive: the server closes one idle for 60 seconds.
# reconnect=5 retries after 5 s; close code 4001 means the id was rotated.
ws.run_forever(ping_interval=25, reconnect=5)

// Requires iOS 13+ / macOS 10.15+ (URLSessionWebSocketTask — no deps needed)
import Foundation

let guid = "YOUR_GUID"
let channel = "notifications"
let url = URL(string: "wss://ws.webskts.com/ws/\(guid)/\(channel)")!
let task = URLSession.shared.webSocketTask(with: url)
task.resume()

func receive() {
    task.receive { result in
        switch result {
        case .success(let message):
            if case .string(let text) = message,
               let json = try? JSONSerialization.jsonObject(with: Data(text.utf8)) as? [String: Any],
               json["type"] as? String == "message" {
                print("[\(json["channel"]!)] \(json["event"]!):", json["data"]!)
            }
            receive() // loop
        case .failure(let error):
            print("Error:", error)
        }
    }
}
receive()

// The server closes a socket that sends nothing for 60 seconds.
Timer.scheduledTimer(withTimeInterval: 25, repeats: true) { _ in
    task.send(.string("ping")) { _ in }
}

// OkHttp (already included in Android) — add to build.gradle if needed:
// implementation 'com.squareup.okhttp3:okhttp:4.12.0'
import okhttp3.*
import org.json.JSONObject

val guid = "YOUR_GUID"
val channel = "notifications"
val request = Request.Builder()
    .url("wss://ws.webskts.com/ws/$guid/$channel")
    .build()

// pingInterval keeps the socket alive: the server closes one idle for 60 seconds.
OkHttpClient.Builder().pingInterval(25, java.util.concurrent.TimeUnit.SECONDS).build()
    .newWebSocket(request, object : WebSocketListener() {
    override fun onMessage(ws: WebSocket, text: String) {
        val msg = JSONObject(text)
        when (msg.getString("type")) {
            "connected" -> println("Ready: ${msg.getJSONArray("channels")}")
            "message"   -> println("[${msg.getString("channel")}] ${msg.getString("event")}: ${msg.get("data")}")
        }
    }
    override fun onFailure(ws: WebSocket, t: Throwable, r: Response?) =
        println("Error: $t")
})

<?php
// A channel token: a JWT (HS256) signed with your signing secret.
function webskts_channel_token(string $secret, array $claims): string
{
    $b64 = fn (string $s): string => rtrim(strtr(base64_encode($s), '+/', '-_'), '=');
    $input = $b64('{"alg":"HS256","typ":"JWT"}') . '.'
           . $b64(json_encode($claims, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE));
    return $input . '.' . $b64(hash_hmac('sha256', $input, $secret, true));
}

// For the signed-in user, only the channels they may join:
$token = webskts_channel_token(getenv('WEBSKTS_SIGNING_SECRET'), [
    'guid'     => 'YOUR_GUID',
    'sub'      => (string) $user->id,                 // who they are
    'channels' => ['private-orders-' . $user->id, 'presence-room-*'],
    'iat'      => time(),
    'exp'      => time() + 3600,                      // at most 24 hours
    'info'     => ['name' => $user->name],            // shown to other members
    'client_events' => ['presence-room-*'],           // where they may send
]);
header('Content-Type: application/json');
echo json_encode(['token' => $token]);

const crypto = require('crypto');

// A channel token: a JWT (HS256) signed with your signing secret.
function channelToken(secret, claims) {
    const b64 = (s) => Buffer.from(s).toString('base64url');
    const input = b64('{"alg":"HS256","typ":"JWT"}') + '.' + b64(JSON.stringify(claims));
    return input + '.' + crypto.createHmac('sha256', secret).update(input).digest('base64url');
}

// For the signed-in user, only the channels they may join:
app.get('/realtime/token', requireLogin, (req, res) => {
    const now = Math.floor(Date.now() / 1000);
    res.json({ token: channelToken(process.env.WEBSKTS_SIGNING_SECRET, {
        guid: 'YOUR_GUID',
        sub: String(req.user.id),
        channels: [`private-orders-${req.user.id}`, 'presence-room-*'],
        iat: now,
        exp: now + 3600,                       // at most 24 hours
        info: { name: req.user.name },         // shown to other members
        client_events: ['presence-room-*'],    // where they may send
    }) });
});

import base64, hashlib, hmac, json, os, time

# A channel token: a JWT (HS256) signed with your signing secret.
def channel_token(secret: str, claims: dict) -> str:
    b64 = lambda b: base64.urlsafe_b64encode(b).rstrip(b"=").decode()
    signing_input = b64(b'{"alg":"HS256","typ":"JWT"}') + "." + b64(
        json.dumps(claims, separators=(",", ":")).encode())
    sig = hmac.new(secret.encode(), signing_input.encode(), hashlib.sha256).digest()
    return signing_input + "." + b64(sig)

# For the signed-in user, only the channels they may join:
now = int(time.time())
token = channel_token(os.environ["WEBSKTS_SIGNING_SECRET"], {
    "guid": "YOUR_GUID",
    "sub": str(user.id),
    "channels": [f"private-orders-{user.id}", "presence-room-*"],
    "iat": now,
    "exp": now + 3600,                     # at most 24 hours
    "info": {"name": user.name},           # shown to other members
    "client_events": ["presence-room-*"],  # where they may send
})

curl https://api.webskts.com/api/channels/presence-deck-42/receipts \
  -H "Authorization: Bearer YOUR_API_KEY"

<?php
$ch = curl_init('https://api.webskts.com/api/channels/' . rawurlencode('presence-deck-42') . '/receipts');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
]);
$r = json_decode(curl_exec($ch), true);
curl_close($ch);
// Who has handled the newest message on the channel
foreach ($r['receipts'] as $receipt) {
    $seen = $receipt['acked'] >= $r['latest_id'];
    echo $receipt['id'], $seen ? ' is up to date' : ' is behind', "\n";
}
echo 'No receipt yet: ', implode(', ', $r['missing'] ?? []), "\n";

const res = await fetch('https://api.webskts.com/api/channels/' + encodeURIComponent('presence-deck-42') + '/receipts', {
    headers: { 'Authorization': 'Bearer YOUR_API_KEY' }
});
const r = await res.json();
const behind = r.receipts.filter((x) => x.acked < r.latest_id).map((x) => x.id);
console.log('Behind:', behind, 'No receipt yet:', r.missing ?? []);

import requests
from urllib.parse import quote

r = requests.get(
    'https://api.webskts.com/api/channels/' + quote('presence-deck-42', safe='') + '/receipts',
    headers={'Authorization': 'Bearer YOUR_API_KEY'}
).json()
behind = [x['id'] for x in r['receipts'] if x['acked'] < r['latest_id']]
print('Behind:', behind, 'No receipt yet:', r.get('missing', []))

<script src="https://webskts.com/resources/webskts_push_client.js"></script>
<script>
// With a token, the client reports each message once your handlers
// have run. Nothing else to do.
const client = new PushClient({
    host: 'wss://ws.webskts.com',
    guid: 'YOUR_GUID',
    getToken: async () => (await (await fetch('/realtime/token')).json()).token,
});
const deck = client.subscribe('presence-deck-42');
deck.on('slide', (data) => showSlide(data));
client.connect();

// Or report only what was really looked at:
//   new PushClient({ ..., ack: 'manual' })
//   deck.on('slide', (data, raw) => { showSlide(data); client.ack(raw.channel, raw.id); });
</script>

<script src="https://webskts.com/resources/webskts_push_client.js"></script>
<script>
  const client = new PushClient({
    host: 'wss://ws.webskts.com',
    guid: 'YOUR_GUID',
    channels: ['announcements'],           // public channels, as before
    // Called on every (re)connect and before the token expires.
    getToken: async () => {
      const res = await fetch('/realtime/token', { credentials: 'same-origin' });
      return (await res.json()).token;
    },
  });

  const room = client.subscribe('presence-room-42');
  room
    .on('$subscribed', () => render(room.members))     // Map id → info, you included
    .on('$member_added', (m) => render(room.members))  // { id, info }
    .on('$member_removed', (m) => render(room.members))
    .on('$subscription_error', ({ reason }) => console.warn(reason))
    .on('client-typing', (data, { user_id }) => showTyping(user_id, data));

  noteField.addEventListener('input', () => room.send('client-typing', { field: 'note' }));
  client.on('$auth_error', ({ reason }) => console.warn('token refused:', reason));
  client.connect();
</script>

# Push to one channel
curl -X POST https://api.webskts.com/api/push \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "notifications",
    "event": "order-update",
    "data": { "order_id": 42, "status": "shipped" }
  }'

# Broadcast to multiple channels
curl -X POST https://api.webskts.com/api/broadcast \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "channels": ["notifications", "alerts"],
    "event": "maintenance",
    "data": { "message": "Scheduled downtime at midnight" }
  }'

<?php
function pushserver_send($endpoint, $payload): array {
    $ch = curl_init('https://api.webskts.com' . $endpoint);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_POST           => true,
        CURLOPT_POSTFIELDS     => json_encode($payload),
        CURLOPT_HTTPHEADER     => [
            'Authorization: Bearer YOUR_API_KEY',
            'Content-Type: application/json',
        ],
    ]);
    $body = curl_exec($ch);
    curl_close($ch);
    return json_decode($body, true);
}

// Push to one channel
pushserver_send('/api/push', [
    'channel' => 'notifications',
    'event'   => 'order-update',
    'data'    => ['order_id' => 42, 'status' => 'shipped'],
]);

// Broadcast to multiple channels
pushserver_send('/api/broadcast', [
    'channels' => ['notifications', 'alerts'],
    'event'    => 'maintenance',
    'data'     => ['message' => 'Scheduled downtime at midnight'],
]);

// Node.js 18+ (built-in fetch) — or replace with axios/node-fetch
const BASE = 'https://api.webskts.com';
const API_KEY = 'YOUR_API_KEY';

async function push(endpoint, payload) {
    const res = await fetch(BASE + endpoint, {
        method: 'POST',
        headers: {
            'Authorization': `Bearer ${API_KEY}`,
            'Content-Type': 'application/json',
        },
        body: JSON.stringify(payload),
    });
    return res.json();
}

// Push to one channel
await push('/api/push', {
    channel: 'notifications',
    event: 'order-update',
    data: { order_id: 42, status: 'shipped' },
});

// Broadcast to multiple channels
await push('/api/broadcast', {
    channels: ['notifications', 'alerts'],
    event: 'maintenance',
    data: { message: 'Scheduled downtime at midnight' },
});

# pip install requests
import requests

BASE = 'https://api.webskts.com'
HEADERS = {
    'Authorization': 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json',
}

# Push to one channel
requests.post(f'{BASE}/api/push', json={
    'channel': 'notifications',
    'event': 'order-update',
    'data': {'order_id': 42, 'status': 'shipped'},
}, headers=HEADERS)

# Broadcast to multiple channels
requests.post(f'{BASE}/api/broadcast', json={
    'channels': ['notifications', 'alerts'],
    'event': 'maintenance',
    'data': {'message': 'Scheduled downtime at midnight'},
}, headers=HEADERS)

require 'net/http'
require 'json'
require 'uri'

def push(endpoint, payload)
  uri = URI("https://api.webskts.com#{endpoint}")
  http = Net::HTTP.new(uri.host, uri.port)
  http.use_ssl = true
  req = Net::HTTP::Post.new(uri)
  req['Authorization'] = 'Bearer YOUR_API_KEY'
  req['Content-Type']  = 'application/json'
  req.body = payload.to_json
  JSON.parse(http.request(req).body)
end

# Push to one channel
push('/api/push', {
  channel: 'notifications',
  event: 'order-update',
  data: { order_id: 42, status: 'shipped' }
})

# Broadcast
push('/api/broadcast', {
  channels: ['notifications', 'alerts'],
  event: 'maintenance',
  data: { message: 'Scheduled downtime at midnight' }
})

package main

import (
    "bytes"; "encoding/json"; "fmt"; "net/http"
)

const (
    base   = "https://api.webskts.com"
    apiKey = "YOUR_API_KEY"
)

func push(endpoint string, payload any) error {
    body, _ := json.Marshal(payload)
    req, _ := http.NewRequest("POST", base+endpoint, bytes.NewReader(body))
    req.Header.Set("Authorization", "Bearer "+apiKey)
    req.Header.Set("Content-Type", "application/json")
    resp, err := http.DefaultClient.Do(req)
    if err == nil { resp.Body.Close() }
    return err
}

func main() {
    // Push to one channel
    push("/api/push", map[string]any{
        "channel": "notifications",
        "event":   "order-update",
        "data":    map[string]any{"order_id": 42, "status": "shipped"},
    })
    // Broadcast to multiple channels
    push("/api/broadcast", map[string]any{
        "channels": []string{"notifications", "alerts"},
        "event":    "maintenance",
        "data":     map[string]any{"message": "Scheduled downtime"},
    })
    fmt.Println("Done")
}

# Push a reading and keep it as the channel's current value
curl -X POST https://api.webskts.com/api/push \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "device-17",
    "event": "reading",
    "data": { "temp": 21.5 },
    "retain": true
  }'

# Every channel holding a retained message (without the data)
curl https://api.webskts.com/api/retained \
  -H "Authorization: Bearer YOUR_API_KEY"

# One channel's retained message, with its data
curl https://api.webskts.com/api/channels/device-17/retained \
  -H "Authorization: Bearer YOUR_API_KEY"

# Clear it
curl -X DELETE https://api.webskts.com/api/channels/device-17/retained \
  -H "Authorization: Bearer YOUR_API_KEY"

<script src="https://webskts.com/resources/webskts_push_client.js"></script>
<script>
const client = new PushClient({
    host:     'wss://ws.webskts.com',
    guid:     'YOUR_GUID',
    channels: ['device-17'],
});
client.on('reading', (data, raw) => {
    // On joining, the retained reading arrives first, marked
    // raw.retained, with server_time saying when it was sent.
    // It can arrive again after a reconnect: treat it as the
    // current value, not as a new event.
    showTemperature(data.temp, raw.retained ? raw.server_time : null);
});
client.connect();
</script>

<?php
// pushserver_send() from "Sender examples"
pushserver_send('/api/push', [
    'channel' => 'device-17',
    'event'   => 'reading',
    'data'    => ['temp' => 21.5],
    'retain'  => true,
]);

// push() from "Sender examples"
await push('/api/push', {
    channel: 'device-17',
    event: 'reading',
    data: { temp: 21.5 },
    retain: true,
});

# BASE and HEADERS from "Sender examples"
requests.post(f'{BASE}/api/push', json={
    'channel': 'device-17',
    'event': 'reading',
    'data': {'temp': 21.5},
    'retain': True,
}, headers=HEADERS)

# Send the same key on every attempt: a repeat is answered with the
# first response (and Idempotency-Replayed: true), not sent again.
curl -X POST https://api.webskts.com/api/push \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-42:shipped" \
  --retry 3 --max-time 10 \
  -d '{
    "channel": "orders",
    "event": "shipped",
    "data": { "order_id": 42 }
  }'

<?php
function pushserver_send_once(string $endpoint, array $payload, string $key): array {
    for ($attempt = 1; ; $attempt++) {
        $ch = curl_init('https://api.webskts.com' . $endpoint);
        curl_setopt_array($ch, [
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_POST           => true,
            CURLOPT_POSTFIELDS     => json_encode($payload),
            CURLOPT_TIMEOUT        => 10,
            CURLOPT_HTTPHEADER     => [
                'Authorization: Bearer YOUR_API_KEY',
                'Content-Type: application/json',
                'Idempotency-Key: ' . $key,   // the same on every attempt
            ],
        ]);
        $body   = curl_exec($ch);
        $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);
        // A timeout, 409 (the first attempt is still running) or a 5xx: try again.
        $retry = $body === false || $status === 409 || $status >= 500;
        if (!$retry) {
            return json_decode($body, true) ?? [];
        }
        if ($attempt === 3) {
            throw new RuntimeException("Push failed after 3 attempts (HTTP $status)");
        }
        sleep($attempt);
    }
}

pushserver_send_once('/api/push', [
    'channel' => 'orders',
    'event'   => 'shipped',
    'data'    => ['order_id' => 42],
], 'order-42:shipped');

// Node.js 18+ (built-in fetch)
async function pushOnce(endpoint, payload, key) {
    for (let attempt = 1; ; attempt++) {
        let res = null;
        try {
            res = await fetch('https://api.webskts.com' + endpoint, {
                method: 'POST',
                headers: {
                    'Authorization': 'Bearer YOUR_API_KEY',
                    'Content-Type': 'application/json',
                    'Idempotency-Key': key,   // the same on every attempt
                },
                body: JSON.stringify(payload),
                signal: AbortSignal.timeout(10000),
            });
        } catch (e) { /* a timeout or a network error: try again */ }
        // 409: the first attempt is still running; 5xx: try again.
        if (res && res.status !== 409 && res.status < 500) return res.json();
        if (attempt === 3) throw new Error('Push failed after 3 attempts');
        await new Promise((r) => setTimeout(r, attempt * 1000));
    }
}

await pushOnce('/api/push', {
    channel: 'orders',
    event: 'shipped',
    data: { order_id: 42 },
}, 'order-42:shipped');

# pip install requests
import time
import requests

def push_once(endpoint, payload, key):
    headers = {
        'Authorization': 'Bearer YOUR_API_KEY',
        'Content-Type': 'application/json',
        'Idempotency-Key': key,   # the same on every attempt
    }
    for attempt in range(1, 4):
        try:
            res = requests.post('https://api.webskts.com' + endpoint, json=payload, headers=headers, timeout=10)
            # 409: the first attempt is still running; 5xx: try again.
            if res.status_code != 409 and res.status_code < 500:
                return res.json()
        except requests.RequestException:
            pass   # a timeout or a network error: try again
        if attempt < 3:
            time.sleep(attempt)
    raise RuntimeError('Push failed after 3 attempts')

push_once('/api/push', {
    'channel': 'orders',
    'event': 'shipped',
    'data': {'order_id': 42},
}, 'order-42:shipped')

curl https://api.webskts.com/api/stats \
  -H "Authorization: Bearer YOUR_API_KEY"

<?php
$ch = curl_init('https://api.webskts.com/api/stats');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
]);
$stats = json_decode(curl_exec($ch), true);
curl_close($ch);
echo "Connections: {$stats['connections']['total']}";
echo "Msgs this hour: {$stats['quota']['messages_this_hour']['used']}";

const res = await fetch('https://api.webskts.com/api/stats', {
    headers: { 'Authorization': 'Bearer YOUR_API_KEY' }
});
const stats = await res.json();
console.log('Connections:', stats.connections.total);
const hourly = stats.quota.messages_this_hour;
if (hourly.limit) {
    console.log(`Hourly: ${hourly.used} / ${hourly.limit} (${hourly.pct}%)`);
} else {
    console.log(`Hourly: ${hourly.used} (unlimited)`);
}

import requests

stats = requests.get(
    'https://api.webskts.com/api/stats',
    headers={'Authorization': 'Bearer YOUR_API_KEY'}
).json()
print(f"Connections: {stats['connections']['total']}")
hourly = stats['quota']['messages_this_hour']
if hourly['limit']:
    print(f"Hourly: {hourly['used']} / {hourly['limit']} ({hourly['pct']}%)")
else:
    print(f"Hourly: {hourly['used']} (unlimited)")

# When does this token expire? Every answer to it says (absent: never).
curl -s -o /dev/null -D - https://webskts.com/api/projects?limit=1 \
  -H "Authorization: Bearer YOUR_ACCOUNT_TOKEN" | grep -i '^api-token-expires'
# Api-Token-Expires: 2027-01-31T09:30:00Z

# Swap it for a successor: same name, scopes and lifetime. The old one
# keeps working for "overlap" seconds (default 86400) while you switch.
curl -X POST https://webskts.com/api/_api_tokens/rotate \
  -H "Authorization: Bearer YOUR_ACCOUNT_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: rotate-2027-01-01" \
  -d '{"overlap": 86400}'

<?php
// Run once a day (cron). load_token() / save_token() are your secrets store.
function webskts_keep_token_current(): void {
    $token = load_token();
    $ch = curl_init('https://webskts.com/api/projects?limit=1');
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 30, CURLOPT_HEADER => true,
        CURLOPT_HTTPHEADER => ["Authorization: Bearer {$token}"],
    ]);
    $raw = (string) curl_exec($ch);
    curl_close($ch);
    if (!preg_match('/^Api-Token-Expires:\s*(\S+)/mi', $raw, $m)) return;   // a "Never" token
    if (strtotime($m[1]) - time() > 30 * 86400) return;                       // not yet

    $ch = curl_init('https://webskts.com/api/_api_tokens/rotate');
    curl_setopt_array($ch, [
        CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 30,
        CURLOPT_HTTPHEADER => [
            "Authorization: Bearer {$token}",
            'Content-Type: application/json',
            'Idempotency-Key: rotate-' . gmdate('Y-m-d'),   // a retry today gets the same successor
        ],
        CURLOPT_POSTFIELDS => json_encode(['overlap' => 86400]),
    ]);
    $reply  = json_decode((string) curl_exec($ch), true) ?? [];
    $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    if ($status === 409 && ($reply['code'] ?? '') === 'already_rotated') {
        // Not us: something else holds this token. Revoke both on the dashboard.
        alert_ops("webskts token already replaced by …{$reply['successor']['last_four']}");
        return;
    }
    if ($status !== 201) throw new RuntimeException("{$status} " . ($reply['code'] ?? '') . ': ' . ($reply['error'] ?? ''));
    save_token($reply['token']);   // the old one works for another day
}

// Run once a day. loadToken() / saveToken() are your secrets store.
async function keepWebsktsTokenCurrent() {
    const token = await loadToken();
    const probe = await fetch('https://webskts.com/api/projects?limit=1', {
        headers: { 'Authorization': `Bearer ${token}` },
    });
    const expires = probe.headers.get('Api-Token-Expires');
    if (!expires) return;                                              // a "Never" token
    if (Date.parse(expires) - Date.now() > 30 * 86400e3) return;       // not yet

    const res = await fetch('https://webskts.com/api/_api_tokens/rotate', {
        method: 'POST',
        headers: {
            'Authorization': `Bearer ${token}`,
            'Content-Type': 'application/json',
            'Idempotency-Key': 'rotate-' + new Date().toISOString().slice(0, 10),
        },
        body: JSON.stringify({ overlap: 86400 }),
    });
    const reply = await res.json();
    if (res.status === 409 && reply.code === 'already_rotated') {
        // Not us: something else holds this token. Revoke both on the dashboard.
        return alertOps(`webskts token already replaced by …${reply.successor.last_four}`);
    }
    if (res.status !== 201) throw new Error(`${res.status} ${reply.code}: ${reply.error}`);
    await saveToken(reply.token);   // the old one works for another day
}

import datetime, requests

# Run once a day. load_token() / save_token() are your secrets store.
def keep_webskts_token_current():
    token = load_token()
    probe = requests.get('https://webskts.com/api/projects', params={'limit': 1},
                         headers={'Authorization': f'Bearer {token}'}, timeout=30)
    expires = probe.headers.get('Api-Token-Expires')
    if not expires:
        return                                                    # a "Never" token
    left = datetime.datetime.fromisoformat(expires.replace('Z', '+00:00')) - datetime.datetime.now(datetime.timezone.utc)
    if left > datetime.timedelta(days=30):
        return                                                    # not yet

    res = requests.post('https://webskts.com/api/_api_tokens/rotate', json={'overlap': 86400}, timeout=30, headers={
        'Authorization': f'Bearer {token}',
        'Idempotency-Key': 'rotate-' + datetime.date.today().isoformat(),
    })
    reply = res.json()
    if res.status_code == 409 and reply.get('code') == 'already_rotated':
        # Not us: something else holds this token. Revoke both on the dashboard.
        alert_ops(f"webskts token already replaced by …{reply['successor']['last_four']}")
        return
    if res.status_code != 201:
        raise RuntimeError(f"{res.status_code} {reply.get('code')}: {reply.get('error')}")
    save_token(reply['token'])   # the old one works for another day

# Make a project (the same Idempotency-Key on a retry: no second project)
curl -X POST https://webskts.com/api/projects \
  -H "Authorization: Bearer YOUR_ACCOUNT_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: tenant-4821" \
  -d '{"name": "Acme Ltd"}'

# Read it again, with its credentials
curl https://webskts.com/api/projects/PROJECT_ID \
  -H "Authorization: Bearer YOUR_ACCOUNT_TOKEN"

# Rename it
curl -X PATCH https://webskts.com/api/projects/PROJECT_ID \
  -H "Authorization: Bearer YOUR_ACCOUNT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "Acme Group"}'

# Delete it
curl -X DELETE https://webskts.com/api/projects/PROJECT_ID \
  -H "Authorization: Bearer YOUR_ACCOUNT_TOKEN"

<?php
function webskts_account(string $method, string $path, ?array $body = null, ?string $idempotencyKey = null): array {
    $ch = curl_init('https://webskts.com/api/projects' . $path);
    curl_setopt_array($ch, [
        CURLOPT_CUSTOMREQUEST  => $method,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT        => 30,
        CURLOPT_HTTPHEADER     => array_filter([
            'Authorization: Bearer YOUR_ACCOUNT_TOKEN',
            'Content-Type: application/json',
            $idempotencyKey !== null ? "Idempotency-Key: {$idempotencyKey}" : null,
        ]),
        CURLOPT_POSTFIELDS => $body !== null ? json_encode($body) : null,
    ]);
    $reply  = json_decode((string) curl_exec($ch), true) ?? [];
    $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    if ($status >= 400) {
        // $reply['code'] says why: limit_reached, name_invalid, …
        throw new RuntimeException("{$status} {$reply['code']}: {$reply['error']}");
    }
    return $reply;
}

// A project for one of your customers; keep its id and credentials.
// Retrying with the same key after a timeout can't make a second one.
$project = webskts_account('POST', '', ['name' => 'Acme Ltd'], "tenant-{$tenantId}")['project'];
save_tenant_push_settings($tenantId, [
    'project_id'     => $project['id'],
    'connection_id'  => $project['connection_id'],
    'ws_url'         => $project['ws_url'],
    'api_key'        => $project['credentials']['api_key'],
    'signing_secret' => $project['credentials']['signing_secret'],
]);

webskts_account('PATCH', '/' . $project['id'], ['name' => 'Acme Group']);
webskts_account('DELETE', '/' . $project['id']);

async function websktsAccount(method, path, body, idempotencyKey) {
    const res = await fetch('https://webskts.com/api/projects' + path, {
        method,
        headers: {
            'Authorization': 'Bearer YOUR_ACCOUNT_TOKEN',
            'Content-Type': 'application/json',
            ...(idempotencyKey ? { 'Idempotency-Key': idempotencyKey } : {}),
        },
        body: body ? JSON.stringify(body) : undefined,
    });
    const reply = await res.json();
    if (!res.ok) throw new Error(`${res.status} ${reply.code}: ${reply.error}`);
    return reply;
}

// A project for one of your customers; keep its id and credentials.
// Retrying with the same key after a timeout can't make a second one.
const { project } = await websktsAccount('POST', '', { name: 'Acme Ltd' }, `tenant-${tenantId}`);
await saveTenantPushSettings(tenantId, {
    projectId: project.id,
    connectionId: project.connection_id,
    wsUrl: project.ws_url,
    apiKey: project.credentials.api_key,
    signingSecret: project.credentials.signing_secret,
});

await websktsAccount('PATCH', '/' + project.id, { name: 'Acme Group' });
await websktsAccount('DELETE', '/' + project.id);

import requests

API = 'https://webskts.com/api/projects'
HEADERS = {'Authorization': 'Bearer YOUR_ACCOUNT_TOKEN'}

def webskts_account(method, path='', body=None, idempotency_key=None):
    headers = dict(HEADERS, **({'Idempotency-Key': idempotency_key} if idempotency_key else {}))
    res = requests.request(method, API + path, headers=headers, json=body, timeout=30)
    reply = res.json()
    if not res.ok:
        raise RuntimeError(f"{res.status_code} {reply['code']}: {reply['error']}")
    return reply

# A project for one of your customers; keep its id and credentials.
# Retrying with the same key after a timeout can't make a second one.
project = webskts_account('POST', body={'name': 'Acme Ltd'}, idempotency_key=f'tenant-{tenant_id}')['project']
save_tenant_push_settings(tenant_id, {
    'project_id': project['id'],
    'connection_id': project['connection_id'],
    'ws_url': project['ws_url'],
    'api_key': project['credentials']['api_key'],
    'signing_secret': project['credentials']['signing_secret'],
})

webskts_account('PATCH', '/' + project['id'], {'name': 'Acme Group'})
webskts_account('DELETE', '/' + project['id'])