# Authentication

> Secure your API requests with API key authentication.

Canonical: https://nolimitnodes.com/docs/authentication

Your API key belongs to a NoLimitNodes project node.

## Get a key

  ### Open the dashboard

Sign in at [app.nolimitnodes.com](https://app.nolimitnodes.com/dashboard).

  ### Create or open a project

Add a Solana node if the project has no node.

  ### Copy the node key

Open the node page and copy its API key.

  ### Store the key

Place the value in a secret manager or environment variable.

## Authentication by product

| Product | Endpoint | Credential |
|---|---|---|
| JSON-RPC | `https://rpc.nln.clr3.org` | HTTP `x-api-key` |
| WebSocket | `wss://ws.nln.clr3.org` | Upgrade header `x-api-key` |
| Yellowstone SDK | `grpc.nln.clr3.org:443` | SDK token argument, sent as `x-token` |
| Yellowstone raw client | `grpc.nln.clr3.org:443` | gRPC metadata `x-api-key` |
| Enhanced Streams | `stream-1.nln.clr3.org:443` | gRPC metadata `x-api-key` |
| Program Streams | `events.nln.clr3.org:443` | gRPC metadata `x-api-key` |

## HTTP example

```bash
curl https://rpc.nln.clr3.org \
  -H "Content-Type: application/json" \
  -H "x-api-key: YOUR_API_KEY" \
  -d '{"jsonrpc":"2.0","id":1,"method":"getSlot"}'
```

## gRPC example

```bash
grpcurl \
  -H "x-api-key: YOUR_API_KEY" \
  -import-path . \
  -proto enhanced-streams.proto \
  -d '{}' \
  stream-1.nln.clr3.org:443 \
  nln.stream.v1.StreamService/ListTopics
```

## Key rules

- Never put a key in a URL.
- Never ship a key in browser JavaScript.
- Never commit a key.
- Use one key per environment.
- Rotate exposed keys.
- Remove old keys after consumers move.
- Do not log request metadata.

> Warning: A browser WebSocket has no custom header option. Open the NoLimitNodes WebSocket from your backend and relay selected events to the browser.