Authentication

How access works on Supanode: a bearer token on RPC, WebSocket and gRPC, x-token plus database credentials for the Indexer, IP:Port for ShredStream Raw, and the tip for TPU Sender.

// updated 2026-08-26

Access to RPC, WebSocket and gRPC is by token. You get one key when your subscription is provisioned and send it as a header on every request.

NOTE

Provisioning is manual. Subscriptions and credentials are arranged over Telegram (@supanode_tgs) - there is no self-serve sign-up in v1. The token itself is shown once, on issue. Store it somewhere safe; we cannot show it again.

Authorization model by product

Product	Authorization
Bundle (RPC, WebSocket, gRPC)	bearer token, sent as a header
Indexer	`x-token` + database credentials
ShredStream Raw	IP:Port destination - Supanode pushes UDP to your endpoint
TPU Sender	open access - the tip on the transaction is the gate
ShredStream Decoded	to be confirmed - product is coming soon
Dedicated Node	arranged individually on provisioning

Bundle - your token

The same token works on all three interfaces, in either of two header forms. Pick one; they are equivalent.

x-token: sk_your_token_here

Authorization: Bearer sk_your_token_here

A request without a valid token is rejected with HTTP 401 on RPC and WebSocket, and with PermissionDenied on gRPC.

Connecting

# RPC
curl https://fra.sol.supanode.xyz:8899 \
  -H 'Content-Type: application/json' \
  -H 'x-token: sk_your_token_here' \
  -d '{"jsonrpc":"2.0","id":1,"method":"getSlot"}'

# WebSocket
wscat -c wss://fra.sol.supanode.xyz:8900 \
  -H 'x-token: sk_your_token_here'

# gRPC
grpcurl -plaintext -import-path ./proto -proto geyser.proto \
  -H 'x-token: sk_your_token_here' \
  -d '{}' \
  fra.sol.supanode.xyz:10010 geyser.Geyser/GetVersion

On RPC the token is also accepted as x-api-key, or as an api-key / api_key query parameter. The header forms are preferred - a query string ends up in logs and browser history.

WARNING

Treat the token like a password. Anyone holding it can spend your plan's quota. Keep it in an environment variable or a secrets manager, never in a repository or a client-side bundle. If it leaks, message us on Telegram and we will rotate it.

Indexer - x-token plus database credentials

1
Request access
Message us on Telegram: @supanode_tgs.
2
Supanode provisions
You receive an x-token plus a database username and password.
3
Pass both on every query
HTTP Basic with the database credentials, and the x-token header alongside it.

See Indexer Access for connection details and code samples.

ShredStream Raw - IP:Port destination

ShredStream Raw is a UDP push, so there is no header from your side: you tell us where to send the stream and Supanode sends only there. You give us the IP:Port on provisioning and can change it during the subscription over Telegram. One destination IP per subscription.

TPU Sender - open access

TPU Sender uses no token. The tip on every transaction is the gate - a System Program transfer of at least 1,000,000 lamports (0.001 SOL) to one of Supanode's tip accounts. Without a valid tip the transaction is rejected.

Dedicated Node - custom

Dedicated Node authorization is arranged individually on provisioning.

Operational notes

Everything runs through Telegram. Onboarding, credentials, token rotation, refunds: @supanode_tgs.
One token per subscription. Quota is counted against the token, so several machines sharing one token share one budget - see gRPC limits.