Solana Authentication

How access works on Supanode: a bearer token on RPC, WebSocket and gRPC, x-token plus database credentials for the Indexer, IP:Port for ShredStream Raw, and HTTP API-key authentication plus a transaction tip for TPU Sender.

// updated 2026-10-23

Access to RPC, WebSocket and gRPC is by token. You get one key when you activate a Bundle plan or trial in the portal and send it as a header on every request.

NOTE

Bundles are self-serve. Sign in to the Supanode portal with a Solana wallet, activate a plan or a 24-hour trial, and copy your token. It is shown once, on issue: store it somewhere safe. The Indexer, ShredStream Raw and Dedicated Node start in the portal. Request TPU Sender keys directly from Supanode on Telegram; no monthly fee. Request a free trial up to 24 hours from Supanode on Telegram; our team confirms availability and setup. Questions: Telegram support.

Authorization model by product

Product	Authorization
Bundle (RPC, WebSocket, gRPC)	bearer token, sent as a header
Indexer	`x-token` + database credentials
ShredStream Raw	IP:Port destination - Supanode pushes UDP to your endpoint
TPU Sender	HTTP: Bearer or X-Api-Key; QUIK: authorized public key; transaction tip required
Dedicated Node	arranged individually on provisioning

Bundle - your token

The same token works on all three interfaces, in either of two header forms. Pick one; they are equivalent.

x-token: sk_your_token_here

Authorization: Bearer sk_your_token_here

A request without a valid token is rejected with HTTP 401 on RPC and WebSocket, and with PermissionDenied on gRPC.

Connecting

# RPC
curl https://fra.sol.supanode.xyz:8899 \
  -H 'Content-Type: application/json' \
  -H 'x-token: sk_your_token_here' \
  -d '{"jsonrpc":"2.0","id":1,"method":"getSlot"}'

# WebSocket
wscat -c wss://fra.sol.supanode.xyz:8900 \
  -H 'x-token: sk_your_token_here'

# gRPC
grpcurl -plaintext -import-path ./proto -proto geyser.proto \
  -H 'x-token: sk_your_token_here' \
  -d '{}' \
  fra.sol.supanode.xyz:10010 geyser.Geyser/GetVersion

On RPC the token is also accepted as x-api-key, or as an api-key / api_key query parameter. The header forms are preferred - a query string ends up in logs and browser history.

WARNING

Treat the token like a password. Anyone holding it can spend your plan's quota. Keep it in an environment variable or a secrets manager, never in a repository or a client-side bundle. If it leaks, message us on Telegram and we will rotate it.

Indexer - x-token plus database credentials

1
Request access
Start in the portal, signed in with a Solana wallet. Our team sets the Indexer up.
2
Supanode provisions
You receive an x-token plus a database username and password.
3
Pass both on every query
HTTP Basic with the database credentials, and the x-token header alongside it.

See Indexer Access for connection details and code samples.

ShredStream Raw - IP:Port destination

ShredStream Raw is a UDP push, so there is no header from your side: you tell us where to send the stream and Supanode sends only there. Provisioning starts in the portal. You give our team the IP:Port at setup and can change it during the subscription through Telegram support. One destination IP per subscription.

TPU Sender - transport-specific authorization and transaction tip

Request your API key from Supanode on Telegram. Send it as Authorization: Bearer YOUR_API_KEY or X-Api-Key: YOUR_API_KEY on HTTP JSON-RPC requests. For the separate QUIK transport on port 8090, create a key pair and send only your public key to Supanode for authorization. The signed transaction must include a sufficient tip. No monthly subscription. Request a free trial up to 24 hours from Supanode on Telegram; our team confirms availability and setup. See HTTP request examples and transport endpoints.

Dedicated Node - custom

Dedicated Node authorization is arranged individually on provisioning.

Operational notes

Subscriptions start in the portal; TPU Sender keys are issued through Supanode Telegram. Bundles are self-serve; for the other products our team sets them up. Token rotation, refunds and questions: Telegram support.
One token per subscription. Quota is counted against the token, so several machines sharing one token share one budget - see gRPC limits.