WebSocket is a separately restricted capability. An API key or REST approval does not automatically include streaming. Check your account’s odds, WebSocket and any native-source grants before relying on it.
Use supported authentication
Header-capable clients follow the current WebSocket guide. The authenticated browser flow uses a short-lived ticket from the signed-in workspace. Never place a reusable API key in a URL or copy a session token from browser storage.
Keep stream state consistent
Apply validated frames in order and update your resume cursor only after applying a complete frame. Preserve native keys and event IDs. Metadata, lineage or gap changes can require a fresh snapshot; a cursor cannot make a missing interval disappear.
Keep the client reader active for control frames. Respect the documented connection, subscription, backlog and write limits. Source stops, expiry, membership and revocation remain enforceable while connected.
Availability and usage
WebSocket messages do not consume REST data credits. Separately requested REST pages can. The deployed restricted protocol and local capacity tests are not a general customer rollout or production capacity guarantee.
If access is denied or recovery requires a resnapshot, preserve the reason and follow the current guide rather than displaying an old active quote. Contact support with a redacted request/connection reference.