| title | Azure Functions Web PubSub bindings |
|---|---|
| description | Understand how to use Web PubSub bindings with Azure Functions. |
| ms.topic | reference |
| ms.custom | devx-track-extended-java, devx-track-js, devx-track-python |
| ms.date | 01/28/2026 |
| zone_pivot_groups | programming-languages-set-functions-lang-workers |
This set of articles explains how to authenticate, send real-time messages to clients connected to Azure Web PubSub by using Azure Web PubSub bindings in Azure Functions.
| Action | Type |
|---|---|
| Handle client events from Web PubSub | Trigger binding |
| Handle client events from Web PubSub with HTTP trigger, or return client access URL and token | Input binding |
| Invoke service APIs | Output binding |
::: zone pivot="programming-language-csharp"
The extension NuGet package you install depends on the C# mode you're using in your function app:
Functions execute in an isolated C# worker process. To learn more, see Guide for running C# Azure Functions in an isolated worker process.
Add the extension to your project by installing this NuGet package.
[!INCLUDE functions-in-process-model-retirement-note]
Functions execute in the same process as the Functions host. To learn more, see Develop C# class library functions using Azure Functions.
Add the extension to your project by installing this NuGet package.
::: zone-end
::: zone pivot="programming-language-javascript,programming-language-python,programming-language-powershell"
[!INCLUDE functions-install-extension-bundle]
::: zone-end ::: zone pivot="programming-language-java"
Note
The Web PubSub extensions for Java is not supported yet.
::: zone-end
(1)-(2) WebPubSubConnection input binding with HttpTrigger to generate client connection.
(3)-(4) WebPubSubTrigger trigger binding or WebPubSubContext input binding with HttpTrigger to handle service request.
(5)-(6) WebPubSub output binding to request service do something.
You can use connection string or Microsoft Entra identity to connect to Azure Web PubSub service.
By default, an application setting named WebPubSubConnectionString is used to store your Web PubSub connection string. When you choose to use a different setting name for your connection, you must explicitly set that as the key name in your binding definitions. During local development, you must also add this setting to the Values collection in the local.settings.json file.
Important
A connection string includes the authorization information required for your application to access Azure Web PubSub service. The access key inside the connection string is similar to a root password for your service. For optimal security, your function app should use managed identities when connecting to the Web PubSub service instead of using a connection string.
For details on how to configure and use Web PubSub and Azure Functions together, refer to Tutorial: Create a serverless notification app with Azure Functions and Azure Web PubSub service.
If you're using Azure Web PubSub Functions Extensions v1.10.0 or higher, instead of using a connection string with an access key, you can configure your function app to authenticate to Azure Web PubSub using a Microsoft Entra identity.
This approach removes the need to manage secrets and is recommended for production workloads.
Make sure the Microsoft Entra identity used by your function app has been granted an appropriate Azure RBAC role on the target Web PubSub resource:
Identity-based connections in Azure Functions use a set of settings that share a common prefix. By default, Azure Web PubSub Functions extensions look for settings with the prefix WebPubSubConnectionString. You can customize this prefix by setting the connection property in your trigger or binding.
For Azure Web PubSub, the service-specific setting you must provide is the service endpoint URI:
| Property | Environment variable template | Description | Required |
|---|---|---|---|
| Service URI | WebPubSubConnectionString__serviceUri |
The URI of your Web PubSub service endpoint. | Yes |
When hosted in the Azure Functions service, identity-based connections use a managed identity. The system-assigned identity is used by default, although a user-assigned identity can be specified. For more information on how to customize the identity, Common properties for identity-based connections.
When run in other contexts, such as local development, your developer identity is used instead, although this can be customized. See Local development with identity-based connections.
The following example shows how to configure identity-based with default settings:
{
"WebPubSubConnectionString__serviceUri": "https://your-webpubsub.webpubsub.azure.com"
}Note
When using local.settings.json file at local, Azure App Configuration, or Key Vault to provide settings for identity-based connections, replace __ with : in the setting name to ensure names are resolved correctly.
For example, WebPubSubConnectionString:serviceUri.