Skip to main content
A2G uses two transport channels: WebSocket for real-time gameplay, and HTTPS REST for discovery and operations.

​
Primary: WebSocket

Real-time bidirectional gameplay communication uses WebSocket (wss://).
  • TLS 1.2 or higher is REQUIRED. TLS 1.3 is RECOMMENDED. Plain ws:// connections MUST be rejected in production.
  • Each WebSocket frame carries exactly one JSON-encoded message (UTF-8).
  • Maximum message size: 64 KB. Messages exceeding this limit MUST be rejected.
  • Servers SHOULD send a WebSocket ping every 30 seconds. Clients MUST respond with pong.
  • Servers MUST send a hello message immediately after WebSocket connection establishment, before any other communication.

​
Connection URL

Authentication tokens MUST NOT be passed as URL query parameters. Tokens in URLs leak to logs, proxies, and referrer headers. Tokens are transmitted via the authenticate message after connection (see Identity).

​
Secondary: HTTPS REST

Discovery, identity setup, and funding operations use standard HTTPS REST endpoints: REST endpoints use the same TLS requirements as WebSocket. Authentication tokens are passed via Authorization: Bearer {token} header.

​
Rate Limiting

Servers SHOULD implement rate limiting and MUST communicate limits via standard headers:
When rate limited, servers respond with HTTP 429 or WebSocket error code RATE_LIMITED.