A realtime WebSocket API for every screen in your business.

Pikoman is a hosted WebSocket API. Your systems publish with one signed HTTP request, and every dashboard, tablet, browser and bot that should know is told within milliseconds. No polling, no servers of your own to keep running. Your keys are made in your browser, and we only ever receive their public half.

Try the demos Read the quickstart

Every depot sees a shipment move the moment it does.

The background traffic is simulated. This sends one real message through the API to everyone on this page.

On the wire

    What people build with it

    Every feature is a small JSON message on a WebSocket. Its op says what kind of message it is, and each kind has its own colour across the site.

    We never see your private keys

    Every request to Pikoman is signed with Ed25519, and no password or secret key is ever sent. What we store is not enough to publish as your app, or to join its private and presence channels.

    Try it: a new API key

    The dashboard's form, cut down. It makes no key and sends nothing.

    Template
    Rights
    Expires

    The full form also limits a key to channel kinds, channel prefixes and IP addresses. Try every option

    What this key may do

    3 rights, every channel, never expires.

    Can

    • Publish to every channel
    • Count the connections in every channel
    • See who is in every channel, with their member data
    • Be used from any address

    Cannot

    • Disconnect a connection
    • Disconnect everyone at once
    • Join channels or listen
    • Send client events

    Never expires. Delete it when you no longer need it.

    If something leaks

    What leaks What it can be used for
    Pikoman's stored data: database, logs, backups Nothing on your app. Public keys cannot sign, so they cannot publish, or join your private and presence channels.
    One of your API keys Only that key's rights, on its channels, from its addresses, until it expires or you delete it. A deleted key stops working within 30 seconds.
    One signed request The same rights as its key, for what is left of the token's ten minutes at most.
    A user's join token One channel, for the one connection it was made for, for at most ten minutes.

    What this does not cover: someone who took over our running servers could let forged requests through, as with any hosted service. Content that must stay private even then belongs in private-encrypted- channels. How it all works is in Keys and the HTTP API.

    Bots, MCP servers and LLMs can listen too

    Give a bot an API key of its own, with the subscribe right and only the channels it needs. It signs its own join token and connects straight to Pikoman: no web page and no token endpoint of yours in between.

    An AI agent screens every order for fraud as it comes in, and only bothers the staff when something looks off.

    Order botk_3f9a1c0e5b7d2468

    Rights
    subscribe client_events publish
    Channels
    starting with private-orders-
    Addresses
    203.0.113.7
    Expires
    in 30 days

    What the bot sends and gets

    1. join"channel":"private-orders-eu","token":"eyJhbGciOiJFZERTQSIsImtpZCI6Imtf…"
    2. joined"channel":"private-orders-eu"
    3. join"channel":"private-orders-staff","token":"eyJhbGciOiJFZERTQSIsImtpZCI6Imtf…"
    4. joined"channel":"private-orders-staff"
    5. event"channel":"private-orders-eu","event":"created","data":{"order":1041,"total":349,"customer":"returning","bill_to":"SE","ship_to":"SE"}
    6. event"channel":"private-orders-eu","event":"created","data":{"order":1042,"total":18900,"customer":"new","bill_to":"SE","ship_to":"DE"}
    7. send"channel":"private-orders-staff","event":"review","data":{"order":1042,"reason":"new customer, 3× usual amount, ships abroad"}

    The token's header names the key (kid), so Pikoman checks it against that key's rights and limits.

    Already in production

    Three steps from install to first message

    The JavaScript client is one small package. Publishing needs no SDK, only a signed token.

    1. Connect

      Run npm install @pikoman/ws@next and open a connection with your app id from the dashboard.

      app.ts
      import Pikoman from "@pikoman/ws";

const pikoman = new Pikoman("your-app-id");

    2. Listen

      Subscribe to a channel and handle the events you care about. Payloads arrive parsed.

      app.ts
      const orders = pikoman.listen("orders");

orders.on("shipped", (order) => {
  showToast(`Order ${order.id} is on its way`);
});

    3. Publish

      POST to /{channel}/{event} from your backend, with a short-lived token signed by an API key that may publish. Everyone listening gets it. Signing takes a few lines in any language.

      terminal
      curl -X POST https://next-api.pikoman.se/orders/shipped \
  -H "Authorization: Bearer $PIKOMAN_TOKEN" \
  -d '{"id": 1042}'

    Next to Pusher

    Pusher is the service most people know. Both do channels, presence and encrypted channels; the difference is in the keys.

    Pusher Channels Pikoman
    How a request is proven HMAC signature with the app secret Ed25519 signature, valid at most ten minutes
    What the provider holds The same secret you sign with Only public keys
    Rights per key No, a key can do everything Seven rights, plus channel kinds, prefixes, IP addresses and expiry
    A bot joins a private channel Through a client and your own auth endpoint With its own key, nothing in between
    End-to-end encrypted channels private-encrypted- private-encrypted-

    Pusher as described in its public documentation, October 2026. Rights per key work like Stripe's restricted keys, with one difference: a Stripe key is sent with every request, and a Pikoman key never is. Full comparison with Ably and PubNub, prices and how to switch.

    Four demos, all running on this site's own app key

    Each one shows its socket traffic while you use it, so you can see exactly what your app would send and receive.

    Bring your own app

    Sign in with GitHub, create an app and get its keys right away, then follow the quickstart. The example repository is a working SolidJS starter.

    Get an app key View the example

    We are rebuilding the dashboard

    Self-service sign-up is closed while we do. Until the new dashboard is ready we set up apps by hand: write to us with a line about what you are building, and we will set up your app and get back to you.

    Write to hello@pikoman.se