Architecture

Overview

                    ┌──────────────────────────────────────────────────┐
                    │               stockbit.com (Next.js SPA)         │
                    │         JS Bundles → Reverse Engineered          │
                    └──────┬──────────┬──────────┬──────────┬──────────┘
                           │          │          │          │
              ┌────────────┘          │          │          └────────────┐
              ▼                       ▼          ▼                       ▼
     ┌────────────────┐    ┌─────────────────┐    ┌──────────────┐  ┌──────────┐
     │  exodus.stockbit│    │carina.stockbit  │    │  WebSocket   │  │  Others  │
     │  .com           │    │.com             │    │  Services    │  │          │
     │  (Main REST API)│    │(Trading REST)   │    │              │  │  CDN, etc│
     └────────────────┘    └─────────────────┘    └──────────────┘  └──────────┘

Services

Service	Base URL	Purpose
Exodus	`https://exodus.stockbit.com`	Main REST API — user, social, watchlist, chart, company data, chat
Carina	`https://carina.stockbit.com`	Trading REST API — orders, portfolio, balance, cash, history
Trading WS	`wss://wss-trading.stockbit.com/ws` (+ `?type=chart`)	Real-time trading data (prices, orderbook, trades, IEPIEV)
Social WS	`wss://wssocial.stockbit.com`	Social feed & chat real-time updates
General WS	`wss://ws-gen.stockbit.com/v1`	Protobuf-based general WebSocket
Sekuritas API	`https://api-sekuritas.stockbit.com`	Sekuritas auth & data
Legacy API	`https://api.stockbit.com`	Legacy API (versioned: v2.4, v2.5)
Dev API	`https://api.stockbit.io`	Developer API (not yet publicly available)

Tech Stack

Frontend: Next.js SPA (React, Redux Toolkit, styled-components)
Real-time: Protobuf-over-WebSocket (binary frames)
API Style: REST JSON for request/response, Protobuf for streaming data
Trading: Separate trading backend (Carina) with its own JWT tokens
Chat: REST API + Social WebSocket for real-time messaging
Analytics: CleverTap, Sentry, Firebase, TikTok Pixel, Google Tag Manager

Data Flow

1. Authentication Flow

User Login
    │
    ▼
[exodus] GET /user/profile
    │ Returns: main_access_token (JWT)
    │
    ├──→ [exodus] All main REST endpoints (Authorization: Bearer)
    │
    └──→ [exodus] GET /sekuritas/auth/token
              │
              ▼
         [carina] POST /auth/v2/login
              │  Body: { login_token, pin }
              │
              ▼
         Returns: trading_access_token (JWT, different account)
              │
              └──→ [carina] All trading endpoints (Authorization: Bearer)

2. WebSocket Data Flow

    ┌─────────────┐
    │  Client App  │
    └──────┬──────┘
           │
           ▼
    ┌──────────────────────┐
    │ GET /auth/websocket  │
    │ /key                 │
    └──────────┬───────────┘
               │ Returns: wskey
               ▼
    ┌───────────────────────────────────────────┐
    │ WebSocket Connection                      │
    │ wss://wss-trading.stockbit.com/ws         │
    │ wss://wss-trading.stockbit.com/ws?type=chart │
    │ Sub-protocol: ["web"]                     │
    └──────────────────┬────────────────────────┘
                       │
           ┌────────────┴──────────────────────────────┐
           ▼    (Two-Step Handshake)                    ▼
    Frame 1: Auth (no channel)                  Frame 2+: Data Response
    { user_id, key, access_token }              WebsocketWrapMessage
                                                     oneof:
    Frame 2: Subscription (with channel)          f8  → RunningTradeBatch
    { user_id, key, access_token,                 f9  → LivePrice
      channel: { ... } }                          f10 → OrderbookFeed
                                                         (pipe-delimited text)
    ─── Chart WS only ───
    Frame 3+: PingRequest { message: "ping" }
              (sent every ~30s)