Program Streams Authentication and Policy

Every Program Streams call needs an API key.

x-api-key: YOUR_API_KEY

API key

Attach the key as gRPC metadata.

metadata = [("x-api-key", os.environ["NLN_API_KEY"])]

Keep the key in a secret manager or environment variable. Do not send the key to browser code.

Event policy

Some account setups include an event policy. The policy limits programs and topics.

If your dashboard provides a policy, send its exact JSON value:

x-eventstream-policy: {"version":1,"allowed_programs":["pump_fun"],"allowed_topics":["solana.pump_fun.trade_event"]}

Python:

metadata = [    ("x-api-key", os.environ["NLN_API_KEY"]),    ("x-eventstream-policy", json.dumps(policy)),]

Do not invent a broader policy in client code. Server-side account rules still apply.

Policy behavior

• ListTopics returns topics visible to the caller.
• GetTopicSchema follows the same access boundary.
• Subscribe rejects blocked topics.
• A key with server-side topic access does not need a client policy header.

Rotation

1. Create or receive a replacement node credential.
2. Update your secret manager.
3. Restart consumers in stages.
4. Confirm ListTopics.
5. Revoke the old credential.