Authentication

Every stream authenticates with one of your API keys, sent as the Yellowstone x-token. Nothing else is needed: no second secret and no signature.

Where keys come from#

Sign in to the dashboard with GitHub or Discord; the first sign-in creates your account and its organization. The API Keys page lists your keys and creates, renames, rotates and revokes them. Every key starts with rf_live_.

A key is not tied to one product: it works on every server behind every active subscription your account holds, and it stops working on a subscription's servers when that subscription ends.

Sending the key#

• TypeScript (@triton-one/yellowstone-grpc): pass it as the client's second argument, new Client(endpoint, key, undefined).
• Rust (yellowstone-grpc-client): .x_token(Some(key)) on the builder.
• Any other gRPC client: send it as the x-token metadata header on the call.

Rotating and revoking#

Rotation issues a new secret for the same key, and the old secret stops working at once. There is no overlap, so roll the new value out to your clients straight after. Revoking a key removes it from every server.

Treat a key like a password: keep it in an environment variable or a secret store, never in a repository or in front-end code.