docs(socket-auth): authenticated realtime channels and migration guide

[roncodes]

What

• Socket Events (platform/developer-console/socket-events): rewritten around the authenticated flow. The server mints a token with the API key (POST /v1/socket/token; Express, Node SDK, PHP SDK and cURL tabs). The browser gets only the short-lived token, connects with socketcluster-client and an in-memory authEngine (or socket.authenticate(token) before subscribing), refreshes ~60 s before expiry and re-authenticates on deauthenticate. It subscribes to company.{uuid} / api.{key id} / resource channels and handles subscribeFail. The page also covers authorization rules (company scope for API-key tokens, anonymous subscriptions rejected in enforce mode, no client publishing) and the off/log/enforce modes.
• Set Up Real-Time Tracking recipe: same pattern. The old browser-side API-key fetch for active drivers is replaced by a server proxy endpoint.
• System Setup → Socket: the fleetbase/fleetbase-socket image, the 8000 public and 8001 internal listeners (8001 is never exposed), and the env vars SOCKETCLUSTER_AUTH_KEY (shared by API and socket server), SOCKETCLUSTER_AUTH_MODE, SOCKETCLUSTER_PUBLISH_URL, SOCKETCLUSTER_AUTHORIZE_URL, SOCKETCLUSTER_TOKEN_TTL and SOCKETCLUSTER_INTERNAL_PORT. Also covers modes, the log-then-enforce upgrade path and troubleshooting.
• New: Migrating to Authenticated Socket Channels (platform/developer-console/socket-auth-migration), registered in both platform nav meta files. It covers what changes, step-by-step migration and a checklist. The timeline is generic: the change takes effect when your instance or Fleetbase Cloud enables enforce mode.
• New: Extension development → Socket Authentication (extension-development/reference/socket-authentication), the ember-core socket service guide moved here from the ember-core repo. Registered in the nav. The socket section of ember-services now says subscriptions are authorized server-side, and the channel list is fixed to api.{uuid}.
• Storefront: POST /storefront/v1/customers/socket-token (authentication and overview pages). Checkout before responses gain socket_token. New Checkout Status Events section with the checkout.{public_id} payload {checkout, status (paid|completed|failed), order, error}.
• Marketing pages: /developers/api (anonymous driver.driver_xxx) and /platform/developer-console samples use the authenticated pattern. The FAQ and the Fleet-Ops order-tracking page mention token-based subscriptions.

Why

Realtime channels now require short-lived socket tokens. The previous docs showed anonymous subscriptions and, in one recipe, an API key in browser code.

Test plan

• Verified by CI (site build). Not built locally.
• Manual review: MDX prose was checked for stray {}/JSX; new pages appear in the sidebar.

Related PRs

Part of the authenticated realtime channels rollout (socket auth), one PR per repo:

• feat(socket-auth): authenticated realtime channels (tokens, authorizer, signed publish) core-api#290 — tokens, channel authorizer, signed HTTP publish (merge and tag first: fleetops and storefront require fleetbase/core-api ^1.6.69)
• feat(socket-auth): fleetops channel resolvers, driver socket tokens, per-customer tracking channel fleetops#358 — fleetops channel resolvers, driver socket tokens, per-customer tracking channel
• feat(socket-auth): storefront customer and checkout socket tokens, channel resolvers storefront#113 — customer and checkout socket tokens, storefront/checkout resolvers
• feat(socket-auth): Fleetbase socket server with JWT auth and signed internal publish fleetbase#704 — fleetbase/fleetbase-socket server, compose/helm/installer, console socket test page
• feat(socket-auth): authenticate the realtime socket with session socket tokens ember-core#97 — console socket service authenticates with session tokens
• feat(socket-auth): show channel authorization failures in the sockets viewer dev-engine#51 — sockets viewer shows authorization failures
• feat(socket-auth): authenticate realtime socket with driver socket tokens navigator-app#112 — driver app socket tokens
• feat(socket-auth): authenticate realtime socket with customer and checkout socket tokens storefront-app#65 — customer and checkout socket tokens
• feat(socket-auth): generate the socket auth key on install fleetbase-cli#11 — installer generates the socket auth key
• feat(socket-auth): add socket.token() to mint realtime socket tokens fleetbase-js#45, feat(socket-auth): add customer.socketToken() for realtime channels storefront-js#22, feat(socket-auth): add socket->token() to mint realtime socket tokens fleetbase-php#28 — SDK socket token helpers
• docs(socket-auth): authenticated realtime channels and migration guide #120 — docs and migration guide

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
fleetbase-io	Error		Oct 7, 2026 6:35am UTC