Each field says who may read it and who may write it: anyone, signed-in visitors, or only the owner. The owner is you — the Slash Socket app and the admin API — never a page.
A visitor is signed in when the page sends a token your backend made: an HS256 JWT signed with the server's token secret, carrying who they are. The server checks it on its own, without calling slash.tools or anyone else. Turn tokens on with "auth": { "tokens": true }.
PropTypeDescription
substring, requiredThe visitor's stable id in your system. Map entries and counter limits use it.expnumber, requiredExpiry, in Unix seconds. Keep it short — the client fetches a fresh token on every reconnect.namestringShown as the visitor's name (up to 80 characters).avatarstringAn http(s) image URL.The secret is SOCKET_TOKEN_SECRET on slash-socket-server. On your Mac, Slash Socket makes one for you: Fields → Visitor tokens → Secret copies it, and Test token copies a signed token you can try from a page for an hour. Keep the secret on your backend only.
app/api/socket-token/route.ts
1234567891011121314151617181920212223import { createHmac } from "node:crypto"
const base64url = (data: string) => Buffer.from(data).toString("base64url")
/** A one-hour Slash Socket token for whoever's signed in to your app. */export async function GET() { const user = await getCurrentUser() // your own auth if (!user) return new Response("Signed out", { status: 401 })
const header = base64url(JSON.stringify({ alg: "HS256", typ: "JWT" })) const payload = base64url( JSON.stringify({ sub: String(user.id), name: user.name, avatar: user.image, exp: Math.floor(Date.now() / 1000) + 60 * 60, }) ) const signature = createHmac("sha256", process.env.SOCKET_TOKEN_SECRET!) .update(`${header}.${payload}`) .digest("base64url") return Response.json({ token: `${header}.${payload}.${signature}` })}page.js
123const socket = connect("wss://live.example.com", { token: async () => (await (await fetch("/api/socket-token")).json()).token,})- A token that's wrong or expired closes the connection with code 4001; the client doesn't retry it.
- With "anonymous": false, pages without a token can't connect at all.
- read: "signed-in" hides a field from anonymous pages entirely — they don't receive its state or its changes.