# `Bourse.WS.Auth.WsApiSignature`
[🔗](https://github.com/ZenHive/bourse/blob/main/lib/bourse/ws/auth/ws_api_signature.ex#L1)

Signed WebSocket-API request that opens binance's spot user data stream.

Binance removed the spot and margin listen key endpoints on 2026-02-20 —
`POST /api/v3/userDataStream` answers HTTP 410 Gone (observed on
`testnet.binance.vision` 2026-08-06). The replacement is a request on the
WebSocket API host: `userDataStream.subscribe.signature`, carrying the API
key, a timestamp and an HMAC-SHA256 signature over the sorted parameters.

The venue offers a second route — `session.logon` followed by an unsigned
`userDataStream.subscribe` — but that one requires Ed25519 keys, which this
client's credentials are not. The signature variant is the HMAC path and
needs no session of its own.

## The frame both authenticates and subscribes

There is no separate channel to subscribe to afterwards: the accepted request
*is* the user data stream. That is why it runs as the private section's
handshake — `Bourse.WS.connect/3` returning an accepted socket means the
stream is live. Verified differentially against
`ws-api.testnet.binance.vision` 2026-08-06: with the request sent, an order
placed on the same account produced `executionReport` and
`outboundAccountPosition`; on a connection that skipped it, the identical
order produced nothing.

## Response

    %{"id" => "…", "status" => 200, "result" => %{"subscriptionId" => 0}}

Any other `status` is the venue's rejection and carries `error.msg`.

---

*Consult [api-reference.md](api-reference.md) for complete listing*