WebSocket transport
OPC UA over WebSockets uses the opc.wss:// or wss:// scheme, default port 4843, and comes in two shapes. wss-uasc-uabinary carries the ordinary UA Binary secure channel inside WebSocket binary frames under sub-protocol opcua+uacp. wss-uajson carries UA JSON in text frames with no UA secure channel - security is TLS only.
Why it exists
Two reasons: browsers, which can open a WebSocket but not a raw TCP socket, and networks that only pass TLS traffic on well-known ports through inspecting proxies. A WebSocket connection starts as an HTTPS request and upgrades, so it traverses infrastructure that would drop opc.tcp outright. The trade is throughput and, for the JSON variant, the security model.
The two variants are not equivalent
With wss-uasc-uabinary you keep the full UA security model - signing and encryption at the OPC UA layer, on top of TLS - so a TLS-terminating proxy still cannot read or forge messages. With wss-uajson there is no UA secure channel: the endpoint is advertised as MessageSecurityMode None, and anything that terminates TLS sees and can alter plaintext service calls. Choose deliberately.
The OpenAPI variant and browser tokens
The WebSocket OpenAPI profile negotiates its bearer token inside the WebSocket sub-protocol name - opcua+openapi+<accesstoken> - rather than in an Authorization header, precisely because browser fetch and WebSocket APIs cannot set arbitrary headers on the upgrade request. It is an unusual pattern, and it means access tokens appear in the sub-protocol field of any capture or proxy log.
Example
Sub-protocols and what each variant secures
opc.wss://gateway.plant.local:4843/UA/Server
sub-protocol profile UA security wire
opcua+uacp wss-uasc-uabinary Sign/SignAndEncrypt UA Binary, binary frames
opcua+uajson wss-uajson None (TLS only) UA JSON, text frames
opcua+openapi wss-uajson-openapi None (TLS only) OpenAPI JSON, text frames
opcua+openapi+<token> wss-uajson-openapi None (TLS only) bearer token in sub-protocol nameDefined in: Part 6 - Mappings, the WebSocket transport mappings; Part 7 - Profiles for the profile URIs.
Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.