Native Conveyor / HTTP Requests Both modes

HTTP Requests

OpenSwoole WebSocket servers can also handle HTTP requests. Conveyor uses HTTP for native auth and broadcast endpoints, and for Pusher-compatible REST publishing.

Method	Path	Mode
POST	`/conveyor/auth`	native
POST	`/conveyor/message`	native
POST	`/apps/{app_id}/events`	pusher
POST	`/apps/{app_id}/batch_events`	pusher
GET	`/apps/{app_id}/channels…`	pusher

Native auth endpoint Native

POST/conveyor/auth?token=…

Creates a temporary channel auth token.

Redact server credentials from logs. The token query parameter on /conveyor/auth and /conveyor/message contains the reusable server credential used between trusted services, such as Laravel and Conveyor. Omit or redact it in proxy and access logs and monitoring traces, for example /conveyor/auth?token=[REDACTED]. Replace the server token if it is exposed. The returned temporary channel token is a separate, single-use credential.

shell

curl -X POST "http://127.0.0.1:8989/conveyor/auth?token=local-server-token" \
  -H "Content-Type: application/json" \
  -d '{"channel":"orders.1"}'

jsonresponse

{
  "auth": "temporary-token"
}

Use the returned auth value in a later channel-connect message for the same channel. Temporary channel tokens are consumed after one use.

Native server broadcast Native

POST/conveyor/message?token=…

Forces a server-side broadcast to a native channel. The JSON body includes channel and message.

shell

curl -X POST "http://127.0.0.1:8989/conveyor/message?token=local-server-token" \
  -H "Content-Type: application/json" \
  -d '{"channel":"orders.1","message":"order updated"}'

jsonresponse

{
  "success": "Message sent successfully!"
}

Common errors

Status	Message	When
401	`Unauthorized!`	Missing or invalid `token` when one is required.
400	`Channels not enabled!`	Channel persistence is unavailable.
404	`Channel not found!`	No socket is connected to the channel.
400	`Invalid message!`	No non-empty `message` in the body.

Pusher REST publish Pusher/Reverb

In Pusher/Reverb-compatible mode, Laravel usually sends these requests through its reverb or pusher broadcaster.

Publish one event

POST/apps/{app_id}/events

json

{
  "name": "OrderShipped",
  "channels": ["orders.1"],
  "data": "{\"id\":1,\"total\":99}",
  "socket_id": "123.456"
}

Body fields: name, channels (or a single channel), data, and optional socket_id.
data must be a string, limited to 10000 bytes.
When socket_id is set, Conveyor does not deliver the event to that socket.

Publish a batch

POST/apps/{app_id}/batch_events

json

{
  "batch": [
    {
      "name": "OrderShipped",
      "channel": "orders.1",
      "data": "{\"id\":1}"
    }
  ]
}

Batches are limited to 10 events.

Inspect channels

GET/apps/{app_id}/channels

GET/apps/{app_id}/channels/{channel}

GET/apps/{app_id}/channels/{presence-channel}/users

Signing

Requests must include these signed query parameters:

auth_keyauth_timestampauth_version=1.0body_md5auth_signature

body_md5 applies to requests with a body.
Timestamp tolerance is 600 seconds.
Bad app credentials, body hashes, or signatures return 401. Stale timestamps return 400.
The example router in examples/pusher-real/router.php signs requests with Conveyor\SubProtocols\Pusher\PusherSigner.