AutoSecure Engine · WebSocket
Drive the securing engine, live. Open one socket and operate the real thing: pull proofs, fire an OTP, poll an authenticator prompt, hand over an MSA token, and watch each secure land through streamed log and event_response frames as it happens. This is the same engine the dashboard runs on — event in, acknowledgement out, progress on the wire. One connection per user; authenticate first, then command it.
Socket wss://sten.cafe/api/Connection & Events Requires API access (redeem a code in Settings → API Keys). Generate keys with WebSocket API Access enabled.
API Key: You need an API key with "WebSocket API Access" enabled. Generate one in Settings → API Keys with the WebSocket option checked.
API Key
Connect ○ Disconnected
Connection & AuthenticationConnect to the WebSocket API and authenticate with your API key:
Complete ExampleFull example showing all message types in order:
Security & Limits
EventsAvailable operations. All events return results via WebSocket response.
WS getaccountsGet your secured accounts. No user_id needed - automatically returns your accounts.
WS getproofsGet available authentication proofs for an email. Use this before sending OTP or polling auth app.
WS sendotpSend OTP to a specific proof obtained from getproofs.
WS authappPoll for authenticator app approval. Display the entropy number to the user - they must select this number…
WS otpSecure an account using an email OTP code. Typical completion: 30-60 seconds.
WS seckeySecure an account using a TOTP secret key (authenticator app). Typical completion: 30-60 seconds.
WS recoverycodeSecure an account using a recovery code. Typical completion: 30-60 seconds.
WS msaauthSecure an account using an MSA auth token (from browser session). Typical completion: 20-40 seconds.
WS statusGet the status of a secure operation by UID. Can optionally validate the account.
WS mailFetch emails from the mail service for a given address.
WS lunarGet Lunar Client cosmetics for an account using its access token.
Connection Status (not an event)Check your connection status and rate limit info. Use type: "status" directly.
Optional Settings ReferenceThese optional settings can be included in otp, seckey, recoverycode, and msaauth events:
Response FlowAll secure operations follow a two-step response pattern:
Error ResponsesIf an operation fails, you'll receive an error response with details:
Rate Limit Error
WebSocket Error CodesComprehensive list of all error codes you may encounter:
Bot API RPC Methods These RPC methods are called over the same WebSocket connection using type: "rpc" instead of type: "event". Bot methods are scoped to bots owned by the authenticated API key owner.
RPC api.bots.indexesGet the database indexes for your bots. Call this first if you do not know what to pass as bot_id .…
RPC api.codes.generateGenerate a share link/code for one of your bots. Non-admin users need API access, an active subscription,…
RPC api.logs.sendSend a named verification log through an owned running bot. The bot's configured logging mode,…
RPC api.hits.sendSend a secure-result hit through an owned bot's hits channel. The bot's secure embed template is the…
RPC api.verification.startCompatibility flow: create an API-owned verification session for one bot and emit the initial…
RPC api.verification.submitOtpCompatibility flow: submit an OTP for an API-owned verification session created by api.verification.start…
RPC api.verification.submitAuthCompatibility flow: submit a Microsoft auth token for an API-owned verification session created by…
RPC api.verification.session.createRecommended: Create an API-attached verification session tied to your bot. This creates server-side…
How To Create The SessionSend this RPC after authenticating the WebSocket with your API key. bot_id is required and must identify…
Session-Attached Lifecycle
Automatic Bot Log EventsThese are emitted only when a valid session-attached session_id is supplied. Each log uses the session…
Session-Attached vs Direct Mode
RPC Error Codes
Nothing on this surface matches that search.
