Open a WebSocket session, send your token, and the session stays authenticated for its lifetime.
💡 The first frame on a new session must be
TOKEN_AUTH. Anything sent before it is rejected.
⚠️ Generating a new token immediately invalidates the old one. Rotate deliberately — a live bot will drop off as soon as you do.
wss://<nandboxBotServer>:<port>/nandbox/api/
For example: wss://w1.nandbox.net:5020/nandbox/api/
Send TOKEN_AUTH as the first message.
| Field | Type | Required | Description |
|---|---|---|---|
method |
String | Yes | "TOKEN_AUTH" |
token |
String | Yes | The token from QUICK START. Shaped <accountId>:<chatId>:<secret>. |
rem |
Boolean | Optional | true keeps the session authenticated until you revoke it. |
| When | Method | What it tells you |
|---|---|---|
| Success | TOKEN_AUTH_OK |
The session is live. Carries your bot's ID and name. |
| Bad token | error 100099 |
Authentication failed. Check the token, then reconnect. |
Once you have TOKEN_AUTH_OK, the session is ready for everything else — sending messages, managing signups, and receiving events. Media transfer is separate and goes over HTTPS; see MEDIA.
The connection is long-lived, and an idle one gets dropped. Every SDK handles this for you: a background thread wakes every 30 seconds and sends {"method": "PING"} if nothing has crossed the socket for 60 seconds.
If you are writing your own client, do the same.
Each SDK reads the token from its config file and calls connect, then hands you an api object in the connect callback.
| SDK | Config file | Connect callback |
|---|---|---|
| Java | config.properties |
onConnect(Api api) |
| JavaScript | config.json |
onConnect(api) |
| Python | config.json |
on_connect(self, api) |