Sandbox version
For experimental use only. Proceed with caution.
Authentication
Honeycluster's public endpoints are open and keyless. This page covers when you'd use an API key (private plans, enterprise clusters) and how to manage them in the portal.

Honeycluster's public endpoints are unauthenticated. You can connect to https://honeycluster.io (or the testnet / devnet subdomains) from any client — including a browser — without providing any credentials. This page exists to cover the cases where you do authenticate: dedicated enterprise clusters, private endpoints, and the portal's account/tRPC surface.

If you're only using the public cluster, you can skip most of this page. See Rate Limits for the shared-tier fair-use policy that applies to anonymous traffic.

When you need a key
##

You need an API key when:

  • You're on an Enterprise plan with a dedicated private endpoint.
  • You've purchased elevated rate limits above the shared-tier fair-use ceiling and need per-project metering.
  • You're consuming the Honeycluster Management API (tRPC endpoints under the portal) to automate project, key, and billing operations.

Public rippled/Clio traffic never requires a key.

Creating a key
##
  1. Open the project you want to issue a key for. If you haven't created one, start from Projects → New Project.
  2. Go to Keys → New Key, give it a human-readable label (e.g. production-indexer), and copy the generated value.

Keys are only shown once at creation time. If you lose the value, revoke the key and issue a new one.

Using the key
##
HTTP (Node.js)
###
TypeScript
const response = await fetch('https://YOUR-PRIVATE-ENDPOINT.honeycluster.io', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-API-Key': process.env.HONEYCLUSTER_API_KEY!,
  },
  body: JSON.stringify({
    method: 'ledger',
    params: [{ ledger_index: 85123456, transactions: true, expand: true }],
  }),
})

const data = await response.json()

The body shape is the XRP Ledger's standard JSON-RPC envelope (method + params: [{}]). Private endpoints accept the same methods as the public cluster, just behind authentication.

WebSocket (Node.js only)
###

In a Node runtime the X-API-Key header can ride along on the HTTP upgrade request because Node's ws library lets you set arbitrary headers. With xrpl.js:

TypeScript
import { Client } from 'xrpl'

const client = new Client('wss://YOUR-PRIVATE-ENDPOINT.honeycluster.io', {
  headers: { 'X-API-Key': process.env.HONEYCLUSTER_API_KEY! },
})

await client.connect()

Browsers cannot set custom WebSocket headers

The browser WebSocket API only accepts a URL and a subprotocol list — there is no way to set X-API-Key on the opening handshake from JavaScript running in a browser. This is a Web Platform restriction, not a Honeycluster one.

If your private endpoint requires an API key and you also need browser clients, proxy browser traffic through a backend you control. See Proxying Requests for the pattern (and a real example from the explorer app).

For the public honeycluster.io endpoint, this doesn't apply — browsers can connect directly without any header.

Scope and isolation
##

Each key is tied to a single project. A project owns its own rate-limit tier and usage history. To isolate staging from production traffic, create two projects and issue one key per project — don't share a single key across environments.

Rotation
##

API keys don't expire, but you should rotate them periodically:

  1. Create a new key on the same project.
  2. Deploy the new key to your runtime (env var, secret store, etc.).
  3. Revoke the old key from the portal once the new one is serving live traffic and the old one shows zero requests in the usage dashboard.

Revoke immediately if a key leaks — revocation takes effect within seconds.

Never ship keys to the browser

API keys grant project-wide access and are not scoped per user. If you have a private endpoint that requires one, put the key behind your own backend and proxy frontend calls through it. See the Node.js proxy tutorial for a concrete example.