In Mattermost 3.5 and later, you can authenticate your WebSocket by connecting and then providing the token in a JSON formatted authentication challenge over the WebSocket.
An example authentication challenge would look like this:
{
"seq": 1,
"action": "authentication_challenge",
"data": {
"token": "mattermosttokengoeshere"
}
}
If the WebSocket authenticates correctly then you will receive a standard ok response looking like this:
{
"status": "OK",
"seq_reply": 1
}
All previous versions of Mattermost before 3.5 will require the token in the cookie. Mattermost 3.5 still supports authenticating through the cookie.
See this forum post for further information: https://forum.mattermost.org/t/how-to-pass-credentials-to-websocket-from-external-domain/2500/2