Authentication

RPC, WebSocket, and Yellowstone gRPC use the access key shown in your service's details in the dashboard. Shreds is pushed to your configured UDP destination.

Access keys

Copy the key from the active service's details. A key belongs to that service; your dashboard login token is not a data-service access key.

Connection	Key placement
RPC and SWQoS	?api-key=YOUR_SERVICE_ACCESS_KEY in the endpoint URL
WebSocket	?api-key=YOUR_SERVICE_ACCESS_KEY in the connection URL
Yellowstone gRPC and Flash gRPC	x-token: YOUR_SERVICE_ACCESS_KEY gRPC metadata

RPC and SWQoS

Append your key to the regional endpoint. These docs use api-key; RPC also accepts api_key as the query parameter name.

curl --silent --show-error "https://rpc.ny.shreds.xyz/?api-key=$SHREDS_API_KEY" \
  -H 'Content-Type: application/json' \
  --data '{"jsonrpc":"2.0","id":1,"method":"getSlot"}'

The same URL format applies to SWQoS, for example https://swqos.ny.shreds.xyz/?api-key=YOUR_SERVICE_ACCESS_KEY. Tools that accept a custom RPC URL should receive the full URL, including its key parameter.

RPC also supports x-api-key, api-key, or x-token headers for clients that prefer header authentication. Use either the query parameter or a supported header. Do not use an api_key header; use that spelling only as a query parameter.

WebSocket

wss://ws.ny.shreds.xyz/?api-key=YOUR_SERVICE_ACCESS_KEY

Use the api-key query parameter when opening the connection. URL-encode the key when constructing URLs in code. Keep service keys on your server when building public applications.

gRPC

Enable TLS and attach x-token metadata to the call. gRPC uses metadata instead of the RPC query parameter. See the gRPC connection check.

Shreds destinations

Register your receiving server's public IPv4 address and UDP port in the dashboard, such as 203.0.113.42:8001, substituting your own address. Allow inbound UDP on that port. The dashboard validates the permitted port range. Trials may require support to set or change the destination.

Store and rotate keys

Use environment variables or a secret manager. URLs containing an API key are credentials: redact them from logs, screenshots, and support reports. Use URL.searchParams or equivalent URL-encoding tools when constructing URLs in code.

If Rotate key is available, rotation immediately disables the previous key. Update every configured URL and gRPC client, then reconnect long-lived connections. If rotation is unavailable, contact support.