Zorelium Realtime

One socket in, fan-out to everything

A managed WebSocket gateway for applications that need to push state to a lot of clients at once — presence, live counters, order books, device telemetry, collaborative cursors. Clients hold one connection and subscribe to as many channels as they need; you publish over HTTPS and we deal with the sockets.

Connect

A connection is a plain WebSocket. Authenticate with a short-lived token minted by your backend; the browser never sees your app secret.

// browser
const ws = new WebSocket("wss://edge.zorelium.site/connect?v=1.4");

ws.onopen = () => {
  ws.send(JSON.stringify({ op: "auth", token: tokenFromYourBackend }));
  ws.send(JSON.stringify({ op: "subscribe", channels: ["room:42", "presence:room:42"] }));
};

ws.onmessage = (e) => {
  const f = JSON.parse(e.data);       // { op, ch, seq, ts, data }
  if (f.op === "msg") render(f.ch, f.data);
};

Publish

Publishing is an ordinary HTTPS call, so it works from anything that can do a POST — a worker, a cron job, a database trigger, a shell script.

# from your backend
curl -X POST https://edge.zorelium.site/v1/publish \
  -H "Authorization: Bearer $ZRT_APP_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"channel":"room:42","data":{"typing":"ada"}}'

The gateway answers 202 once the frame is accepted for fan-out and returns the sequence number assigned to the channel. Delivery is at-least-once within the retention window; subscribers that reconnect with last_seq get the gap replayed.

Public endpoints

These need no credentials and are safe to poll from a health check or a status board.

Everything else under /v1/ is scoped to an application and requires a bearer token. See the protocol notes for frame shapes and error codes, and limits for the numbers we enforce.

What it is not

• Not a message broker — there are no durable queues, no consumer groups and no dead-letter handling. Retention is a short replay window, not storage.
• Not a transport for large payloads. Frames above 64 KiB are rejected; put the bytes in object storage and publish the URL.
• Not multi-region yet. One region, one failure domain — size your expectations accordingly, and see status for what that has meant in practice.