What you will accomplish
- Open an authenticated private stream
- Parse account and order event types
- Maintain one consistent local account state
- Recover safely from gaps and disconnects
Before you begin
- A read-enabled API key held server-side
- Separate handlers for each event type
- A persistent event log and recovery storage
Keep the API key server-side
Do not expose requestToken in browser code, prompts, screenshots, or client logs.
Connect to the documented private stream
Open wss://app.quote.trade/ws/listenKey from a trusted server and send the documented account, unsubscribe=0, and requestToken message.
Save the subscription response
The documented subscription request uses account, unsubscribe, and requestToken. Record the server response and subsequent event flow exactly; do not assume that another identifier must be reused unless the live server requires it.
Handle account, order, position, and risk events separately
Store ACCOUNT_UPDATE, ORDER_TRADE_UPDATE, and RISK_UPDATE separately. Remove account IDs and balances before sharing examples, and preserve the event times and update IDs returned by the server.
Test disconnect, reconnect, and duplicates
Force a disconnect, reconnect, resubscribe, and compare the new events with a fresh REST account and order response. Ignore duplicate events using stable IDs and timestamps where available.
Unsubscribe and revoke on shutdown
Send the documented unsubscribe=1 message, close the socket, and rotate the key after suspected exposure.
Common problems and fixes
The stream authenticates but sends no events
Confirm the account mapping and create a harmless account change in a controlled environment. Do not place a live order only to test the connection.
Events arrive out of order
Use documented timestamps and IDs, buffer briefly if needed, and reload the current REST state after a gap.
A duplicate event changes balances twice
Store processed event or order IDs and ignore duplicates before updating balances.
The connection drops repeatedly
Check incoming control-message rate, network health, token validity, and server responses before reconnecting aggressively.