nautechsystems/nautilus_trader · error · anyhow::Error

L3 WebSocket failed to authenticate: {e}

Error message

L3 WebSocket failed to authenticate: {e}

What it means

After the L3 WebSocket becomes active, subscribe_l3_book requires it to be authenticated (L3 order books on Kraken Spot v2 need API credentials). `wait_until_authenticated(10.0)` waits on the auth tracker for 10 seconds and returns `KrakenWsError::AuthenticationError("Authentication not completed within 10 seconds")` on timeout or explicit auth failure; the adapter re-wraps it with this message.

Source

Thrown at crates/adapters/kraken/src/data/spot.rs:351

            self.l3_handler_task = self.spawn_l3_handler_task(ws_l3, true);
        }

        let ws_l3 = self
            .ws_l3
            .as_ref()
            .expect("ws_l3 initialized above")
            .clone();

        self.spawn_ws(
            async move {
                ws_l3
                    .wait_until_active(10.0)
                    .await
                    .map_err(|e| anyhow::anyhow!("L3 WebSocket failed to become active: {e}"))?;
                ws_l3
                    .wait_until_authenticated(10.0)
                    .await
                    .map_err(|e| anyhow::anyhow!("L3 WebSocket failed to authenticate: {e}"))?;
                ws_l3
                    .subscribe_book_l3(symbol_ustr, depth)
                    .await
                    .map_err(|e| anyhow::anyhow!("{e}"))
            },
            "subscribe l3 book",
        );

        Ok(())
    }

    fn spawn_l3_handler_task(
        &self,
        handler_client: KrakenSpotWebSocketClient,
        restart: bool,
    ) -> Option<TaskRef> {
        let data_sender = self.data_sender.clone();
        let instruments = self.instruments.clone();

View on GitHub (pinned to 18893faf8b)

Solutions

1. Verify the configured api_key/api_secret are valid, active, and have the required Kraken permissions.
2. Check that the server's IP is allowlisted for the Kraken API key if key IP restrictions are enabled.
3. Test the Kraken auth token REST endpoint reachability from this machine (it is called by refresh_auth_token before the WS auth).
4. Check logs for the L3 handler task's 'L3 WebSocket authentication failed' line to see the underlying auth error.
5. Retry after confirming credentials; if the timeout is marginal due to latency, reduce network latency or file an issue to raise the fixed 10s window.

Example fix

// before (config with invalid creds)
KrakenDataClientConfig::new(api_key, api_secret)
// after — verify credentials work before subscribing
let client = reqwest::Client::new();
// ensure the REST auth-token call succeeds with these credentials first
assert!(refresh_auth_token(&config).await.is_ok(), "invalid Kraken API credentials");
data_client.subscribe_book_deltas(&cmd)?;

// fail fast before subscribing if credentials are absent
if !config.has_api_credentials() {
    anyhow::bail!("L3 order book requires API credentials; configure api_key and api_secret");
}
// optionally validate credentials via a REST token refresh before subscribing
refresh_auth_token(&config).await?;

match client.subscribe_book_deltas(&cmd) {
    Err(e) if e.to_string().contains("failed to authenticate") => {
        // verify/rotate Kraken API keys, check IP allowlist, then retry
        eprintln!("Kraken L3 auth failed: {e}; check API key validity and permissions");
    }
    Err(e) => return Err(e),
    Ok(()) => {}
}

When it happens

Trigger: Calling subscribe_book_deltas when the L3 client's authenticate() fails or never completes within 10s: invalid/expired API key or secret, Kraken REST auth-token endpoint unreachable, wrong passphrase/permissions on the key, or credentials absent (though the client bails earlier in that case).

Common situations: Misconfigured or rotated Kraken API keys; key lacks the required permissions; IP allowlist on the key excludes this server; REST endpoint for token refresh blocked by firewall; slow network making the token exchange exceed 10s.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• missing WS auth token
• Authentication failed: {e}
• WS session authentication timed out
• Coinbase credentials unavailable for WS reset
• failed to authenticate WebSocket session: {e}

AI-assisted analysis of nautechsystems/nautilus_trader@18893faf8b (2026-09-08). Data as JSON: /api/errors/389756aad4027842. Report an issue: GitHub.