Azure Messaging Webpubsubservice Py
MicrosoftOfficialCreated by Microsoft
- Skill
- Tool integration
- Cloud and DevOps
- MIT
- Low risk
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
This skill provides the Python SDK for Azure Web PubSub, enabling developers to implement real-time messaging, manage WebSocket connections, and utilize pub/sub patterns at scale. It covers both server-side service management and client-side WebSocket connectivity, emphasizing secure authentication via DefaultAzureCredential and efficient resource lifecycle management using context managers.
What it does
- Broadcasts messages to all connected clients or specific groups.
- Sends targeted messages to individual users or specific connection IDs.
- Manages user and connection membership within groups.
- Generates secure, short-lived access tokens for client connections.
- Provides both synchronous and asynchronous client implementations.
- Enables monitoring of connection status and permission management.
When to use it
- When building real-time features like chat, live dashboards, or collaborative tools.
- When you need to manage WebSocket connections at scale in an Azure environment.
- When implementing pub/sub messaging patterns between backend services and frontend clients.
- When you require secure, identity-based authentication for real-time communication services.
Advantages
- Supports both sync and async programming models for flexibility.
- Promotes secure practices with DefaultAzureCredential and short-lived tokens.
- Simplifies connection lifecycle management through context managers.
- Provides granular control over messaging targets and group memberships.
Usage examples
- “How do I send a JSON message to all connected clients using the Azure Web PubSub Python SDK?”
- The agent provides a code snippet using the WebPubSubServiceClient.send_to_all method with the content_type set to application/json.
- “Show me how to generate a client access token for a user with specific group permissions.”
- The agent demonstrates the get_client_access_token method, showing how to pass user_id, roles, and group assignments.
- “How should I handle authentication in production for the Web PubSub service?”
- The agent explains the use of DefaultAzureCredential and the requirement to set the AZURE_TOKEN_CREDENTIALS environment variable for production environments.
- “Can I use the Web PubSub SDK asynchronously?”
- The agent provides an example using the azure.messaging.webpubsubservice.aio namespace and async with context managers.
Install
Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/azure-messaging-webpubsubservice-py/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip azure-messaging-webpubsubservice-py.zip -d .agents/skills
Documentation by Microsoft
Azure Web PubSub Service SDK for Python
Real-time messaging with WebSocket connections at scale.
Installation
# Service SDK (server-side)
pip install azure-messaging-webpubsubservice
# Client SDK (for Python WebSocket clients)
pip install azure-messaging-webpubsubclientEnvironment Variables
AZURE_WEBPUBSUB_HUB=my-hub # Required for all auth methods
AZURE_TOKEN_CREDENTIALS=prod # Required only if DefaultAzureCredential is used in productionAuthentication & Lifecycle
🔑 Two rules apply to every code sample below:
Prefer
DefaultAzureCredential. It works locally (Azure CLI / VS Code / Developer CLI) and in Azure (managed identity, workload identity) with no code change. Avoid connection strings, account/API keys — they bypass Entra audit and rotation.
Local dev:
DefaultAzureCredentialworks as-is.Production: set
AZURE_TOKEN_CREDENTIALS=prod(orAZURE_TOKEN_CREDENTIALS=<specific_credential>) to constrain the credential chain to production-safe credentials.Wrap every client in a context manager so HTTP transports, sockets, and token caches are released deterministically:
Sync:
with <Client>(...) as client:Async:
async with <Client>(...) as client:andasync with DefaultAzureCredential() as credential:(fromazure.identity.aio)Snippets may abbreviate this setup, but production code should always follow both rules.
Service Client (Server-Side)
Authentication
from azure.messaging.webpubsubservice import WebPubSubServiceClient
from azure.identity import DefaultAzureCredential, ManagedIdentityCredential
# Local dev: DefaultAzureCredential. Production: set AZURE_TOKEN_CREDENTIALS=prod or AZURE_TOKEN_CREDENTIALS=<specific_credential>
credential = DefaultAzureCredential(require_envvar=True)
# Or use a specific credential directly in production:
# See https://learn.microsoft.com/python/api/overview/azure/identity-readme?view=azure-python#credential-classes
# credential = ManagedIdentityCredential()
with WebPubSubServiceClient(
endpoint="https://<name>.webpubsub.azure.com",
hub="my-hub",
credential=credential
) as client:
# Use `client` for all subsequent operations (see examples below)
...Generate Client Access Token
# Token for anonymous user
token = client.get_client_access_token()
print(f"URL: {token['url']}")
# Token with user ID
token = client.get_client_access_token(
user_id="user123",
roles=["webpubsub.sendToGroup", "webpubsub.joinLeaveGroup"]
)
# Token with groups
token = client.get_client_access_token(
user_id="user123",
groups=["group1", "group2"]
)Send to All Clients
# Send text
client.send_to_all(message="Hello everyone!", content_type="text/plain")
# Send JSON
client.send_to_all(
message={"type": "notification", "data": "Hello"},
content_type="application/json"
)Send to User
client.send_to_user(
user_id="user123",
message="Hello user!",
content_type="text/plain"
)Send to Group
client.send_to_group(
group="my-group",
message="Hello group!",
content_type="text/plain"
)Send to Connection
client.send_to_connection(
connection_id="abc123",
message="Hello connection!",
content_type="text/plain"
)Group Management
# Add user to group
client.add_user_to_group(group="my-group", user_id="user123")
# Remove user from group
client.remove_user_from_group(group="my-group", user_id="user123")
# Add connection to group
client.add_connection_to_group(group="my-group", connection_id="abc123")
# Remove connection from group
client.remove_connection_from_group(group="my-group", connection_id="abc123")Connection Management
# Check if connection exists
exists = client.connection_exists(connection_id="abc123")
# Check if user has connections
exists = client.user_exists(user_id="user123")
# Check if group has connections
exists = client.group_exists(group="my-group")
# Close connection
client.close_connection(connection_id="abc123", reason="Session ended")
# Close all connections for user
client.close_all_connections(user_id="user123")Grant/Revoke Permissions
from azure.messaging.webpubsubservice import WebPubSubServiceClient
# Grant permission
client.grant_permission(
permission="joinLeaveGroup",
connection_id="abc123",
target_name="my-group"
)
# Revoke permission
client.revoke_permission(
permission="joinLeaveGroup",
connection_id="abc123",
target_name="my-group"
)
# Check permission
has_permission = client.check_permission(
permission="joinLeaveGroup",
connection_id="abc123",
target_name="my-group"
)Client SDK (Python WebSocket Client)
from azure.messaging.webpubsubclient import WebPubSubClient
with WebPubSubClient(credential=token["url"]) as client:
@client.on("connected")
def on_connected(e):
print(f"Connected: {e.connection_id}")
@client.on("server-message")
def on_message(e):
print(f"Message: {e.data}")
@client.on("group-message")
def on_group_message(e):
print(f"Group {e.group}: {e.data}")
client.send_to_group("my-group", "Hello from Python!")Async Service Client
from azure.messaging.webpubsubservice.aio import WebPubSubServiceClient
from azure.identity.aio import DefaultAzureCredential
async def broadcast():
async with DefaultAzureCredential() as credential:
async with WebPubSubServiceClient(
endpoint="https://<name>.webpubsub.azure.com",
hub="my-hub",
credential=credential
) as client:
await client.send_to_all("Hello async!", content_type="text/plain")Client Operations
| Operation | Description |
|---|---|
get_client_access_token | Generate WebSocket connection URL |
send_to_all | Broadcast to all connections |
send_to_user | Send to specific user |
send_to_group | Send to group members |
send_to_connection | Send to specific connection |
add_user_to_group | Add user to group |
remove_user_from_group | Remove user from group |
close_connection | Disconnect client |
connection_exists | Check connection status |
Best Practices
Pick sync OR async and stay consistent. Do not mix
azure.xxxsync clients withazure.xxx.aioasync clients in the same call path. Choose one mode per module.Always use context managers for clients and async credentials. Wrap every client in
with Client(...) as client:(sync) orasync with Client(...) as client:(async). For asyncDefaultAzureCredentialfromazure.identity.aio, also useasync with credential:so tokens and transports are cleaned up.Use
DefaultAzureCredentialfor portable auth across local dev and Azure (avoid connection strings / access keys when possible).Use roles to limit client permissions
Use groups for targeted messaging
Generate short-lived tokens for security
Use user IDs to send to users across connections
Handle reconnection in client applications
Use JSON content type for structured data
Close connections gracefully with reasons
Reference Files
| File | Contents |
|---|---|
| references/capabilities.md | Additional non-hero capabilities, operation-group coverage, and production checklists. |
| references/non-hero-scenarios.md | Dedicated non-hero examples for secondary/advanced scenarios. |
Files
- ATTRIBUTION.mdAdded by AutoGineer1016 B
- LICENSELicence file added by AutoGineer1.1 KiB
- SKILL.md7.9 KiB
- references/capabilities.md1.2 KiB
- references/non-hero-scenarios.md3.3 KiB
LICENSE
MIT License
Copyright (c) Microsoft Corporation.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARERequirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Needs an API key, Needs Python
Security
What our scanner noticed· Low risk
- Instructions that use the network
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Created by
- Microsoft
- Publisher
- Microsoft (Official)
- Source
- microsoft/skills · .github/plugins/azure-sdk-python/skills/azure-messaging-webpubsubservice-py · commit 0696600
- Licence
- MIT License (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-messaging-webpubsubservice-py.zip