# SocketIO connector with JWT authentication

**URL:** <https://forum.rasa.com/t/socketio-connector-with-jwt-authentication/55562>\
**Category:** Rasa Open Source\
**Created:** [September 29, 2022, 3:04pm UTC](https://forum.rasa.com/t/socketio-connector-with-jwt-authentication/55562 "2022-09-29T15:04:45Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ybm11](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.rasa.com/ybm11/32/19967_2.png) [@ybm11](https://forum.rasa.com/u/ybm11)\
**Post date:** [September 29, 2022, 3:04pm UTC](https://forum.rasa.com/t/socketio-connector-with-jwt-authentication/55562/1 "2022-09-29T15:04:45Z")

</div>

Hey all,   
  
My goal is to manage the users’ access to my bot. The most reasonable method seems to be implementing a SocketIO connector with JWT authentication.   
My sources are the following 2 links from the documentation:  
 [Your Own Website](https://rasa.com/docs/rasa/connectors/your-own-website)  
[Rasa Open Source HTTP API](https://rasa.com/docs/rasa/http-api)   
  
My 3 questions are:

1. The request structure is different in both documentation pages I mentioned above. At [Your Own Website](https://rasa.com/docs/rasa/connectors/your-own-website), the token should be provided as a part of the JSON body:

```auto
{
  "token": "jwt_encoded_payload"
}

```

While at [Rasa Open Source HTTP API](https://rasa.com/docs/rasa/http-api), the token should be provided as a part of the header:

```auto
"Authorization": "Bearer eyJhbG...VCJ9.eyJ"
                 "zdWIiOiI...gRG9lIi"
                 "wiaWF0I...CWjnDomO"
                 "Gl8e...cgRn-I"

```

And there’s also a notation for username and user role, which does not exist in the other source:

```auto
{
    "user": {
        "username": "<sender_id>",
        "role": "user"
    }
}

```

Which method is correct? 2. In credentials.yml, the following variables shall be defined: `user_message_evt: user_uttered` , `bot_message_evt: bot_uttered` . Are `user_uttered` / `bot_uttered` built-in methods, or should be developed by me?

**credentials.yml**

```auto
socketio:
  user_message_evt: user_uttered
  bot_message_evt: bot_uttered
  session_persistence: true
  jwt_key: my_public_key
  jwt_method: HS256

```

1. If anybody has a complete working JWT-Authenticated SocketIO request structure and can share it, it will be great.   
Thank you!