Skip to content

Information on Using the noVNC WebSocket

Last updated: 2026-08-04

Using the noVNC console via WebSocket

The noVNC console can also be used outside the web interface, for example in your own panel or tooling. The endpoint accepts WebSocket connections on port 443:

wss://novnc.datalix.de/websockify

Authentication

After connecting, the first message must be a JSON object containing your token and the service ID:

{"token": "YOUR-TOKEN", "serviceid": "YOUR-SERVICE-ID"}

Both API keys and session tokens are accepted. Sub-users additionally need the "noVNC console" permission. The message has to be valid JSON, so make sure to use double quotes.

On failure the server replies with Error 1 (invalid JSON) or Error 2 (invalid token or no access to the service) and closes the connection.

After authentication

Once authenticated, the server sends a single text frame containing a temporary VNC password (starting with PVEVNC). From that point on, the connection is a regular VNC-over-WebSocket stream (RFB protocol, binary). Use the password in the VNC handshake and leave the username empty. The password is only valid for the current connection — after a reconnect you need to authenticate again.

The password frame is not part of the VNC stream and must not be passed on to your VNC client.

Example using noVNC (version 1.3 or later)

Stock noVNC does not send the auth message on its own. Starting with version 1.3, you can pass an already open WebSocket to the RFB constructor and handle authentication yourself:

import RFB from './core/rfb.js';

const ws = new WebSocket('wss://novnc.datalix.de/websockify', ['binary']);

ws.addEventListener('open', () => {
    ws.send(JSON.stringify({ token: 'YOUR-TOKEN', serviceid: 'YOUR-SERVICE-ID' }));
});

ws.addEventListener('message', function onAuth(e) {
    if (typeof e.data === 'string' && e.data.startsWith('PVEVNC')) {
        ws.removeEventListener('message', onAuth);
        new RFB(document.getElementById('screen'), ws, {
            credentials: { username: '', password: e.data }
        });
    } else if (typeof e.data === 'string' && e.data.startsWith('Error')) {
        console.error('Authentication failed: ' + e.data);
    }
});

Notes

  • A new one-time password is generated for every connection.
  • The endpoint is limited to 30 connection attempts per minute per service.