Skip to main content

​
API keys

Every request carries an API key. Keys look like XXXXXXX-XXXXXXX-XXXXXX and work across all products your account has access to. Treat them like passwords. Manage keys under API Keys in the dashboard:
  • Create new adds a key.
  • Rename changes a key’s name. The key’s value stays the same.
  • Regenerate replaces a key. The old value stops working immediately.
  • Revoke disables a key for good.

​
Sending the key

Send the key as x-token request metadata.

​
Plan IPs

Plans decide which source IPs can use them. Manage IPs under Plans → Allowed IPs on each product page:
  • Add binds another IP, up to the plan’s limit.
  • Change moves a bound IP to a new address.
  • Remove unbinds an IP.
Changes apply within about a second. A stream that is open from an IP you remove ends with IP_NOT_ALLOWED.
Bind your server’s public IP address as seen from the internet, not a private or internal address.

​
Key restrictions

Each key can carry its own rules under API Keys → Key restrictions. With no rules, a key works from any IP its plans allow. Rules only narrow a key: they never add access, and your plan IPs always work. A request must match one rule of each kind the key has. A key with both IP and domain rules accepts only browser requests from a listed site and a listed address. Changes apply within a few seconds.

​
Domain rules

When a web page calls another site, the browser adds an Origin header naming the page’s site, e.g. https://app.example.com. If a key has domain rules, RPC accepts a request only when that site matches one of them. A request without Origin is checked against its Referer. Enter a hostname only, without https://, a port or a path. Matching ignores case, scheme and port. To accept a domain and its subdomains, add both example.com and *.example.com. From a web page, call RPC over HTTPS; browsers block plain http:// requests from secure pages. RPC answers the browser’s CORS preflight, so fetch and Solana libraries work directly:
A domain rule refuses every request that doesn’t come from a browser: gRPC and Preplay streams, server-side RPC calls and scripts. Use a separate key for those.
  • A domain rule doesn’t hide the key. Anyone who opens your page can read a key it contains. The rule stops other websites from using the key, but a script outside a browser can send any Origin it likes. Requests on the key count toward your account’s rate limits and credits, so regenerate the key if it is abused.
  • Server keys don’t need one. A key used only from your own servers belongs in server-side config, never in front-end code. Restrict it with Key IPs if the servers have fixed addresses.
  • IP rules still apply. Browser requests come from your visitors’ own addresses, so a key with Key IPs or Key CIDRs, or an account that still lists account IPs, refuses them. RPC plans, packages and trials don’t bind RPC to IPs, so a browser key works on any of them.
  • Refused requests get HTTP 401 with -401 Unauthorized. Invalid or expired API key.

​
Trials and pending plans

A trial request needs no IP. Once approved, the trial accepts any IP until you add one under Plans → Allowed IPs.