# Program Streams Authentication and Policy

> Authenticate Program Streams calls and apply an issued event policy.

Canonical: https://nolimitnodes.com/docs/api-reference/program-streams/authentication-policy

Every Program Streams call needs an API key.

```text
x-api-key: YOUR_API_KEY
```

## API key

Attach the key as gRPC metadata.

```python
metadata = [("x-api-key", os.environ["NLN_API_KEY"])]
```

Keep the key in a secret manager or environment variable. Do not send the key to browser code.

## Event policy

Some account setups include an event policy. The policy limits programs and topics.

If your dashboard provides a policy, send its exact JSON value:

```text
x-eventstream-policy: {"version":1,"allowed_programs":["pump_fun"],"allowed_topics":["solana.pump_fun.trade_event"]}
```

Python:

```python
metadata = [
    ("x-api-key", os.environ["NLN_API_KEY"]),
    ("x-eventstream-policy", json.dumps(policy)),
]
```

Do not invent a broader policy in client code. Server-side account rules still apply.

## Policy behavior

- `ListTopics` returns topics visible to the caller.
- `GetTopicSchema` follows the same access boundary.
- `Subscribe` rejects blocked topics.
- A key with server-side topic access does not need a client policy header.

## Rotation

1. Create or receive a replacement node credential.
2. Update your secret manager.
3. Restart consumers in stages.
4. Confirm `ListTopics`.
5. Revoke the old credential.