Connection Diagnostics

Deriv Authentication Flow — Final Report
Generated: 2026-09-07T13:26:56.290Z
Current configured app_id: (none)
WebSocket endpoint: wss://ws.derivws.com/websockets/v3?app_id=<APP_ID>

SUMMARY
-------
The numeric App ID is still required by Deriv. Every WebSocket connection to
wss://ws.derivws.com/websockets/v3 — public (active_symbols, ticks) or
authenticated (OAuth / API token) — must carry ?app_id=<N>. This is not a
legacy requirement; it is how Deriv's current Developer platform identifies
the calling application. There is no OAuth-only or "keyless" mode.

WHERE THE APP ID COMES FROM
---------------------------
Register an application once at https://api.deriv.com/dashboard and copy the
numeric App ID. Ship it with the build via VITE_DERIV_APP_ID or let a user
override it from the Diagnostics page (stored in localStorage). End users
never need to see or paste it in normal use.

REQUIRED AUTH FLOW (CURRENT DERIV API)
--------------------------------------
1. Register app at api.deriv.com/dashboard → obtain numeric app_id.
   Set VITE_DERIV_APP_ID=<N> at build time.

2. Public market data (ticks, active_symbols, candles):
   - Open wss://ws.derivws.com/websockets/v3?app_id=<N>
   - Send requests directly. No user authentication needed.

3. User accounts — OAuth (recommended):
   - Redirect to
     https://oauth.deriv.com/oauth2/authorize?app_id=<N>&l=en&brand=deriv&redirect_uri=<yourReturnUrl>
   - Deriv redirects back with acct1/token1/cur1 … acctN/tokenN/curN query
     parameters.
   - Open a WebSocket with the same app_id and send { authorize: <token1> }.

4. User accounts — API Token (Personal Access Token):
   - User creates a token in Deriv account settings (Security → API token).
   - App sends { authorize: <token> } on the same app_id socket.

5. All subsequent authenticated calls (balance, buy, portfolio, transaction
   stream, proposal_open_contract) reuse the same authorized socket.

FAILURE MODES
-------------
- 0 symbols returned: the App ID is not authorised for this region.
  Register your own App ID and override it via Diagnostics.
- WebSocket closes immediately: usually an invalid or missing app_id.
- Deriv API error { code, message }: shown verbatim in the Diagnostics log
  and in the App ID Test panel's raw response.

• Public WebSocket URL

  Unauthenticated market data (ticks, active_symbols, candles).

  Copy

  wss://ws.derivws.com/websockets/v3?app_id=<APP_ID>

• OAuth authorize URL

  Redirect the user here; Deriv returns acctN/tokenN/curN params.

  Copy

  https://oauth.deriv.com/oauth2/authorize?app_id=<APP_ID>&l=en&brand=deriv&redirect_uri=<YOUR_REDIRECT_URI>

• active_symbols request

  First public call after the socket opens.

  Copy

  {"active_symbols":"brief","product_type":"basic","req_id":1}

• authorize request

  Send with an OAuth token1 or a Personal Access Token.

  Copy

  {"authorize":"<TOKEN>","req_id":2}

• ticks subscribe

  Subscribe to a live tick stream for a symbol (e.g. R_100).

  Copy

  {"ticks":"R_100","subscribe":1,"req_id":3}

• balance subscribe

  Stream authorized account balance updates.

  Copy

  {"balance":1,"subscribe":1,"req_id":4}

• forget_all ticks

  Unsubscribe from every active tick stream.

  Copy

  {"forget_all":"ticks","req_id":5}