# Build Azure Web PubSub Apps with TypeScript

Real-time TypeScript applications require secure connection, messaging, and event handling patterns. This skill provides focused Azure Web PubSub examples for clients, servers, groups, and Express handlers.

## Install

```bash
npx skillstore add sickn33/azure-web-pubsub-ts
```

## Metadata

- Status: approved
- Slug: sickn33-azure-web-pubsub-ts
- Skillstore revision: r2
- Version status: missing
- Tree hash: 82a3570e610043be567f419dcc76c9e824ca9047cd995a34e83232eebb7aa0d1
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/azure-web-pubsub-ts
- Ref: 5a26d1d61d694db29af9b138c661c1981076d9df
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network, env\_access
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/sickn33-azure-web-pubsub-ts
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-azure-web-pubsub-ts/manifest

## Capabilities

- Shows Azure Web PubSub server client authentication with connection strings, Entra ID, and key credentials.
- Demonstrates client access token generation with user identities, roles, groups, and expiration settings.
- Covers broadcast, user, connection, filtered, and group message delivery.
- Explains group membership, connection closure, and permission management operations.
- Provides browser client connection, event handling, group messaging, and reconnection examples.
- Shows Express middleware for connection validation, user events, lifecycle events, and negotiation.

## Use Cases

- Prototype a Team Chat: Create group-based messaging, authenticated connections, and browser event handlers for a TypeScript chat prototype.
- Add Operational Notifications: Send targeted updates to users, connections, or filtered audiences from an Azure-hosted service.
- Review Web PubSub Integration: Compare token, permission, connection, and event-handler patterns before approving an implementation.

## Prompt Templates

### Create a Basic Client

```
Show a minimal TypeScript Azure Web PubSub client that obtains a URL from an authenticated negotiate endpoint and handles group messages.
```

### Design Group Messaging

```
Design TypeScript server and client flows for joining named groups, sending messages, preventing echoes, and handling reconnection failures.
```

### Secure Token Negotiation

```
Review my Azure Web PubSub negotiate flow. Recommend authentication, least-privilege roles, expiration, error handling, and controls that prevent token exposure.
```

### Plan a Production Integration

```
Produce an implementation plan for Azure Web PubSub with TypeScript and Express, including identity, authorization, groups, observability, scaling, failure handling, and tests.
```

## Limitations

- The examples are reference snippets, not a complete deployable application.
- The skill does not configure Azure resources, identities, networking, or production monitoring.
- Authentication and authorization require application-specific middleware and policy design.
- Examples require validation against current Azure SDK versions and local TypeScript settings.

## Best Practices

- Prefer DefaultAzureCredential and managed identities instead of long-lived connection strings.
- Authenticate negotiation requests and issue short-lived tokens with only required roles and groups.
- Register handlers before connecting, validate event data, and test reconnect and rejoin failures.

## Anti Patterns

- Do not log client access URLs because they contain bearer tokens.
- Do not expose a negotiation endpoint without authentication and authorization.
- Do not grant broad send, group, or connection permissions when narrower access is sufficient.

## Security Audit

- Audited at: 2026-08-14T09:31:30.765\+00:00
- Summary: All 47 static alerts are false positives caused by Markdown fences, TypeScript template literals, placeholder URLs, intended SDK networking, or named environment configuration. Semantic review found two high-risk documentation patterns: logging a bearer-token URL and showing a negotiation route without demonstrated authentication.

## Stats

- Views: 86
- Downloads: 7
- Favorites: 0
- Popularity score: 0