nautechsystems/nautilus_trader · critical · anyhow::Error

missing WS auth token

Error message

missing WS auth token

What it means

Raised in `submit_via_ws` when submitting a single order over the Kraken spot private WebSocket: `self.ws.auth_token_blocking()` returned `None`, meaning no Kraken WS authentication token is available. Kraken's private WS (`send`/`add_order`) requires a token obtained via the authenticated REST `GetWebSocketsToken` endpoint using valid API key/secret with appropriate permissions.

Source

Thrown at crates/adapters/kraken/src/execution/spot.rs:498

                            due_post_only,
                        );
                    }
                },
            }

            Ok(())
        });
    }
    fn submit_via_ws(
        &self,
        command: &SubmitOrder,
        order: &OrderAny,
        leverage: Option<u16>,
    ) -> anyhow::Result<()> {
        let token = self
            .ws
            .auth_token_blocking()
            .ok_or_else(|| anyhow::anyhow!("missing WS auth token"))?;

        let params = build_add_order_params(command, order, token, leverage)?;
        let identity = PendingRequest {
            operation: PendingOperation::Submit,
            client_order_ids: vec![command.client_order_id],
            venue_order_ids: vec![None],
            ts_sent_ns: 0,
            new_quantity: None,
            new_price: None,
            new_trigger_price: None,
        };
        self.order_request_state
            .submit(params, identity, self.clock.get_time_ns().as_u64())?;
        Ok(())
    }

    fn cancel_single_order(&self, cmd: &CancelOrder) {
        let use_ws_trade = resolve_use_ws_trade(cmd.params.as_ref(), self.config.use_ws_trade);

View on GitHub (pinned to 18893faf8b)

Solutions

1. Configure valid Kraken API key/secret (env vars or KrakenExecClientConfig) so the client can obtain a WS auth token.
2. Verify the API key has the necessary trading permissions on Kraken's account settings.
3. Check startup logs for a failed GetWebSocketsToken request and fix connectivity/credentials, then reconnect.
4. If tokens expire periodically, ensure the client is reconnected/token-refreshed before submitting orders.

Example fix

// before (token never configured)
let config = KrakenExecClientConfig::default(); // no api_key/api_secret

// after
let config = KrakenExecClientConfig {
    api_key: Some(api_key),          // from env/secret store
    api_secret: Some(api_secret),
    ..Default::default()
};
client.connect()?; // fetches WS auth token before trading

// Before submitting, ensure credentials are present so a WS auth token can be obtained.
if api_key.is_empty() || api_secret.is_empty() {
    return Err(anyhow::anyhow!("Kraken API key/secret required for WS order submission"));
}

match client.submit_single_order(cmd) {
    Err(e) if e.to_string().contains("missing WS auth token") => {
        client.reconnect()?; // re-acquire GetWebSocketsToken, then retry
        client.submit_single_order(cmd)?;
    }
    other => other?,
}

When it happens

Trigger: Calling `submit_single_order` (which routes to `submit_via_ws`) when the auth token was never fetched, the token fetch failed at startup, credentials are absent/invalid, or the token expired and was not refreshed before the call.

Common situations: Running the execution client without API key/secret configured; wrong environment (demo credentials on live or vice versa); network failure at startup preventing token acquisition; token expired after a long-idle session; API key lacking the required Kraken permission.

Related errors

• L3 WebSocket failed to authenticate: {e}
• limit_price is required for order type {order_type:?}
• handler command channel closed: {e}
• Authentication failed: {e}
• Coinbase credentials unavailable for WS reset

AI-assisted analysis of nautechsystems/nautilus_trader@18893faf8b (2026-09-08). Data as JSON: /api/errors/9f4f7d045d1adccc. Report an issue: GitHub.