WebSocket API Development for Real-Time Web Apps

Imagine your chat or dashboard lags due to polling requests every 500 ms. Users complain about delays, and the backend is overwhelmed by N+1 queries. The solution is WebSocket: a persistent connection with latency under 10 ms instead of seconds. WebSocket is over 100x faster than traditional polling. Replacing polling with WebSocket cuts network and server load by 10–20 times, reduces server infrastructure costs by 3–5 times (saving $2,000–$5,000 per month), and saves up to 90% of traffic. For example, a fintech client reduced their server costs from $8,000/month to $2,000/month after switching from polling to WebSocket. We have been developing such realtime systems for over 5 years and completed 30+ projects for WebSocket chat applications, notifications, and collaborative work. Bidirectional WebSocket communication instantly delivers ticker updates, cursors, or game events—without unnecessary overhead. WebSocket API development is a core part of our expertise. For Socket.io vs WebSocket decisions, see the comparison table below. We also cover WebSocket API development, WebSocket server setup, implementing WebSocket in apps, WebSocket scaling strategies, WebSocket authentication methods, WebSocket heartbeat mechanisms, Redis Pub/Sub WebSocket scaling, WebSocket rooms management, and the WebSocket protocol.

Problems WebSocket API Solves

• High polling latency: polling every 2 seconds gives up to 2000 ms lag; WebSocket delivers milliseconds.
• Excessive traffic: each poll request sends HTTP headers (700+ bytes); WebSocket sends only data (a few bytes).
• Complexity of realtime features: notifications, cursors, tickers—polling is inefficient.
• Connection drops: mobile networks and proxies close idle channels—heartbeat is required.
• Scaling: a single server cannot handle >10K connections—clustering with Redis Pub/Sub is needed.

How We Develop a WebSocket Solution

We start with architectural design: choose the protocol (native WebSocket or Socket.io), define the message model (JSON schemas), plan authentication, and address scaling. Recently, we implemented a WebSocket server for a fintech startup: 50K concurrent connections, latency under 10 ms, full redundancy via Redis cluster. Below is a typical approach.

Basic Implementation with Rooms (Node.js + ws)

import { WebSocketServer } from 'ws'; import { createServer } from 'http'; const server = createServer(app); const wss = new WebSocketServer({ server }); const rooms = new Map<string, Set<WebSocket>>(); wss.on('connection', (ws, req) => { const roomId = new URL(req.url!, 'http://x').searchParams.get('room'); if (!roomId) return ws.close(4000, 'Missing room'); if (!rooms.has(roomId)) rooms.set(roomId, new Set()); rooms.get(roomId)!.add(ws); ws.on('message', (data) => { const message = JSON.parse(data.toString()); rooms.get(roomId)?.forEach(client => { if (client !== ws && client.readyState === WebSocket.OPEN) { client.send(JSON.stringify(message)); } }); }); ws.on('close', () => { rooms.get(roomId)?.delete(ws); }); }); 

We structure messages as a typed JSON protocol: { type, roomId, data, timestamp }. This simplifies debugging and processing.

Authentication and Security

Since WebSocket does not support custom headers during the handshake, we use the first message for authentication—send the token immediately after connection. If the token is invalid, we close the connection with code 4001.

ws.on('connection', (socket) => { let authenticated = false; const authTimeout = setTimeout(() => { if (!authenticated) socket.close(4001, 'Auth timeout'); }, 5000); socket.once('message', (data) => { const { type, token } = JSON.parse(data.toString()); if (type === 'auth' && validateToken(token)) { authenticated = true; clearTimeout(authTimeout); socket.send(JSON.stringify({ type: 'auth_success' })); } else { socket.close(4001, 'Invalid token'); } }); }); 

This approach is more secure than a query string because the token is not exposed in logs.

Horizontal Scaling with Redis Pub/Sub

When clustering, clients are distributed among different servers. To ensure a message from a client on server 1 reaches a client on server 2, we use Redis Pub/Sub:

import { createClient } from 'redis'; const pub = createClient(); const sub = createClient(); ws.on('message', async (data) => { await pub.publish(`room:${roomId}`, data.toString()); }); sub.subscribe(`room:${roomId}`, (message) => { rooms.get(roomId)?.forEach(client => { if (client.readyState === WebSocket.OPEN) client.send(message); }); }); 

Redis acts as a bus—all servers receive events and deliver them to their clients. This proven solution handles 100K+ connections.

Choosing Between Socket.io and Native WebSocket

For projects with up to 10K connections and non-strict latency requirements, Socket.io is more convenient. Native WebSocket handles 10x more connections than Socket.io under the same resources, so it is better for >10K connections, minimal overhead, and full control over the protocol.

Heartbeat Implementation Importance

Browsers and proxies close idle connections after 20–120 seconds. Heartbeat (ping/pong) every 30 seconds keeps the channel alive and detects disconnections. Without it, clients appear "stuck" in the user list.

wss.on('connection', (ws) => { let alive = true; ws.on('pong', () => { alive = true; }); const interval = setInterval(() => { if (!alive) return ws.terminate(); alive = false; ws.ping(); }, 30000); ws.on('close', () => clearInterval(interval)); }); 

import { WebSocketServer } from 'ws'; import { createServer } from 'http'; const server = createServer(); const wss = new WebSocketServer({ server }); wss.on('connection', (socket, req) => { const roomId = new URL(req.url!, 'http://x').searchParams.get('room'); if (!roomId) { socket.close(4000, 'Missing room'); return; } let authenticated = false; const authTimeout = setTimeout(() => { if (!authenticated) socket.close(4001, 'Auth timeout'); }, 5000); socket.once('message', (data) => { const { type, token } = JSON.parse(data.toString()); if (type === 'auth' && validateToken(token)) { authenticated = true; clearTimeout(authTimeout); socket.send(JSON.stringify({ type: 'auth_success' })); } else { socket.close(4001, 'Invalid token'); } }); let alive = true; socket.on('pong', () => { alive = true; }); const heartbeat = setInterval(() => { if (!alive) { socket.terminate(); return; } alive = false; socket.ping(); }, 30000); socket.on('close', () => { clearInterval(heartbeat); clearTimeout(authTimeout); }); }); server.listen(8080); 

Our Work Process

1. Analysis and prototype—determine load, scenarios, message protocol.
2. Design—architecture, stack selection, authentication scheme.
3. Development—server and client implementation, Redis integration.
4. Testing—load tests (10K+ connections), fault tolerance tests.
5. Deployment and monitoring—CI/CD, SRE dashboards, latency alerts.

What's Included

• Full architectural documentation (PDF/Markdown)
• Repository with server and client code (TypeScript)
• Redis Pub/Sub integration for scaling
• Heartbeat and reconnect mechanism setup
• Deployment guide for your infrastructure
• 1 month of free support after release

Development Timeline

• MVP with rooms and authentication: 2–3 weeks
• Full solution with Redis, tests, and documentation: 3 to 5 weeks

Exact timeline depends on protocol complexity and required load. We will assess your project for free—contact us. Order WebSocket API development, and we guarantee a stable connection even under peak loads.

WebSocket protocol is described in RFC 6455.