A Pusher alternative that never holds your secret

How the keys work

As we read their public documentation, October 2026. PubNub is left out of the second table because we have not checked how it signs requests. Tell us at hello@pikoman.se if we have something wrong, and we will fix it.

Pusher's free 200,000 messages a day come to about 6 million a month, the same as Ably's free plan. Pusher's price is fixed per plan; Ably's paid plans add what you use to the base fee.

In the browser

Install npm install @pikoman/ws@next. subscribe becomes listen and bind becomes on. There is no cluster to choose.

import Pusher from "pusher-js";

const pusher = new Pusher("app-key", { cluster: "eu" });

const orders = pusher.subscribe("orders");
orders.bind("order-shipped", (data) => {
  console.log(data.id);
});

import Pikoman from "@pikoman/ws";

const pikoman = new Pikoman("app-yourapp");

const orders = pikoman.listen("orders");
orders.on("order-shipped", (data) => {
  console.log(data.id);
});

Private and presence channels

Channel names keep their private- and presence- prefixes. Pusher's auth endpoint becomes a token endpoint: the client asks GET {auth_url}/{clientId}-{channel} and your backend answers with a join token signed by the app's private key. Messages between members need no client- prefix, and their handlers get the sender's connection id first.

const pusher = new Pusher("app-key", {
  cluster: "eu",
  channelAuthorization: { endpoint: "/pusher/auth" },
});

const room = pusher.subscribe("presence-room");
room.bind("client-typing", (data) => showTyping(data));
room.trigger("client-typing", { on: true });

const pikoman = new Pikoman("app-yourapp", {
  auth_url: "/pikoman/auth",
});

const room = pikoman.listenPresence("presence-room");
room.on("typing", (from, data) => showTyping(data));
room.send("typing", { on: true });

app.post("/pusher/auth", (req, res) => {
  const { socket_id, channel_name } = req.body;
  if (!mayJoin(req.user, channel_name)) return res.sendStatus(403);
  res.send(pusher.authorizeChannel(socket_id, channel_name, {
    user_id: req.user.id,
    user_info: { name: req.user.name },
  }));
});

import { OfflineAuthenticator } from "@pikoman/ws";

app.get("/pikoman/auth/:join", async (req, res) => {
  const [clientId, channel] = req.params.join.split(/-(.*)/);
  if (!mayJoin(req.user, channel)) return res.sendStatus(403);
  const signer = new OfflineAuthenticator({ name: req.user.name },
    process.env.PIKOMAN_PRIVATE_KEY, 3);
  res.json({ token: await signer.authenticate(clientId, channel) });
});

Connection ids never contain -, so the path splits at the first one. OfflineAuthenticator signs with the private key from the dashboard; 3 makes a full member. A PHP endpoint and one with no library are in the quickstart. A custom request, such as a POST with a CSRF token, works with your own authenticator.

Publishing from your backend

trigger becomes publish. The API key from the dashboard signs a short-lived token for each request, so the key itself is never sent.

import Pusher from "pusher";

const pusher = new Pusher({
  appId: "123456",
  key: "app-key",
  secret: process.env.PUSHER_SECRET,
  cluster: "eu",
});

await pusher.trigger("orders", "order-shipped", { id: 1042 });

import { Rest } from "@pikoman/ws";

const rest = new Rest({
  app: "app-yourapp",
  apiKey: process.env.PIKOMAN_API_KEY,
});

await rest.publish("orders", "order-shipped", { id: 1042 });

From PHP or Python, signing the token takes about ten lines, and the request is a plain POST. Encrypted channels keep the private-encrypted- name; how keys reach the clients is in Encrypted channels.

• Webhooks

  Pusher can call your server when a channel fills or empties and when members come and go. Pikoman has no webhooks. Your backend can ask with stats and clients instead.

• Libraries in many languages

  Pusher has official server libraries for many languages, and clients for iOS and Android. Pikoman has a JavaScript client and a Rust crate. Other languages sign tokens by hand, which the docs show for PHP and Python.

• Laravel broadcasting

  Laravel has a Pusher driver built in, and Laravel Echo speaks Pusher's protocol. Neither works with Pikoman.

• Push notifications

  Pusher has mobile push notifications as a separate product, Beams. Pikoman only reaches open connections.

• A long track record

  Pusher has run in production for many years. Pikoman 2.0 is new: the client is a release candidate, and we publish no SLA. The status page shows our measured uptime.