Keys are shown once and stored only as a hash.
We store only the SHA-256 hash and prefix, never the plaintext key. Do not hardcode keys in browser or mobile apps. If a key is exposed, disable it immediately in the console. The change takes effect across the network within 30 seconds.
Scopes
Grant only the scopes you need. Keep RPC keys separate from billing keys.
- network:read RPC and Data API reads
- network:archive Archive queries
- network:subscribe Event subscriptions
- network:send Broadcast signed transactions (granted separately)
Key rotation
Rotate every 90 days. Create a new key and move traffic to it. Disable the old key once its calls stop.
Pausing blocks new requests, and an admin can resume the key. Revocation is permanent. Rotation retires the old key.
IP allowlist and rate limits
Set a source IP allowlist per key. Requests from outside it are rejected. Each key is capped at its configured requests per minute.
Rate-limited responses return a suggested wait time in seconds.