Authentication

Choose how your clients send their API key, and keep that key out of places it can leak. GraphOps RPC accepts an organization-scoped API key either in the Authorization header or in the endpoint path. Use one authentication method per request.

Create and rotate API keysCopy Anchor Link

Create and rotate API keys in the GraphOps Platform. The platform only shows the plaintext key at creation or rotation time, so store it in your secret manager immediately.

Each query key belongs to one organization and can query the services it includes. Include RPC in the key; one key can also include the other services your application uses. You can also limit a key's RPC access to the networks your application calls; see Limit a key. See API keys for choosing services and rotation.

Use separate keys for production, staging, and local development so you can replace one environment's credentials without affecting the others.

Authentication methodsCopy Anchor Link

Prefer header authentication when your client can set headers. Use route-token authentication when a client cannot attach Authorization during the connection, especially for WebSocket handshakes.

Header authenticationhttps://rpc.graphops.xyz/v1/evm/1Authorization: Bearer <GRAPHOPS_API_KEY>The URL holds no secret

GraphOps RPC

Route-token authenticationwss://rpc.graphops.xyz/v1/evm/1/<GRAPHOPS_API_KEY>The URL is the secret

GraphOps RPC

Full URLs are often copied to

Proxy logsBrowser historyMetrics labelsCrash reports

Header authenticationCopy Anchor Link

Send the API key as a bearer token:

Authorization: Bearer <GRAPHOPS_API_KEY>

Example HTTPS endpoint:

https://rpc.graphops.xyz/v1/evm/1

Use header authentication for server-side HTTPS clients, backend workers, and libraries that support custom request headers.

Route-token authenticationCopy Anchor Link

EVM route-token endpointsCopy Anchor Link

Put the API key after the chain ID:

https://rpc.graphops.xyz/v1/evm/<CHAIN_ID>/<GRAPHOPS_API_KEY>
wss://rpc.graphops.xyz/v1/evm/<CHAIN_ID>/<GRAPHOPS_API_KEY>

For Ethereum mainnet, the route-token endpoints are:

https://rpc.graphops.xyz/v1/evm/1/<GRAPHOPS_API_KEY>
wss://rpc.graphops.xyz/v1/evm/1/<GRAPHOPS_API_KEY>

Bitcoin route-token endpointsCopy Anchor Link

Put the API key after a network name from Supported networks:

https://rpc.graphops.xyz/v1/bitcoin/<NETWORK>/<GRAPHOPS_API_KEY>
https://rpc.graphops.xyz/v1/bitcoin/mainnet/<GRAPHOPS_API_KEY>

Use route-token authentication for WebSocket clients and HTTPS clients that cannot attach custom headers. Do not send the same API key in both the URL and the Authorization header.

WebSocket authenticationCopy Anchor Link

Route-token authentication is the recommended WebSocket pattern because many WebSocket clients cannot send custom Authorization headers during the handshake.

import WebSocket from "ws";

// Route-token URL: the API key is the final path segment.
const socket = new WebSocket(
  `wss://rpc.graphops.xyz/v1/evm/1/${process.env.GRAPHOPS_API_KEY}`,
);

socket.once("error", (error) => { throw error; });
socket.once("open", () => {
  console.log(JSON.stringify({ connected: true }));
  socket.close();
});

If your server-side WebSocket client supports custom headers, header authentication is also valid:

import WebSocket from "ws";

const socket = new WebSocket("wss://rpc.graphops.xyz/v1/evm/1", {
  headers: {
    Authorization: `Bearer ${process.env.GRAPHOPS_API_KEY}`,
  },
});

socket.once("error", (error) => { throw error; });
socket.once("open", () => {
  console.log(JSON.stringify({ connected: true }));
  socket.close();
});

Security guidanceCopy Anchor Link

• Store API keys in a server-side secret manager when possible.
• Keep organization API keys out of public frontend bundles and send requests through your backend, unless you use a browser key whose services are each limited to your website's origins and to the targets your frontend queries.
• Use separate keys per environment. A route-token URL exposes the key to anyone who can read it.
• Redact API keys from URLs before logging request paths, WebSocket URLs, errors, or metrics.
• Rotate keys from the platform when a key or route-token URL is exposed.

Next stepsCopy Anchor Link