Abuse prevention
Our Philosophy
We take a proactive approach to abuse prevention with two primary goals:
Protect Your Application: Ensure that malicious traffic doesn't disrupt the service for your legitimate users.
Protect Your Bill: Prevent runaway bots or abusive traffic from causing unexpected charges.
Our abuse prevention systems are a core feature built over several years of experience running high-demand public and private endpoints.
How We Protect You
Our strategy is a multi-layered defense designed to filter out malicious traffic while allowing legitimate requests to pass through smoothly. Key components include:
Access Control (Endpoints vs. Tokens): We provide a clear distinction between two methods of access. Public Endpoints are for your frontend dApp and are secured by an allowlist of web origins you provide. Secret Tokens are for your backend services and must be kept private.
Intelligent Rate Limiting: Our platform enforces carefully tuned Rate Limits based on IP address and other factors to prevent any single actor from overwhelming the service.
Traffic Filtering: Our load balancers inspect incoming traffic to ensure it conforms to valid JSON-RPC specifications. Malformed requests or traffic that doesn't resemble a useful RPC call is denied at the edge before it can impact backend nodes.
Advanced Fingerprinting: We employ sophisticated fingerprinting techniques to identify and block malicious actors attempting to circumvent our security measures, such as by spoofing authentication credentials or web origins. This protects against more advanced and persistent abuse patterns.
Your Role in Security
Properly using endpoints and tokens is the most important step you can take to secure your service.
NEVER expose a secret Token in public source code, like a frontend JavaScript application. Use your public Endpoint URL instead.
ALWAYS keep your Tokens secure on your backend, treating them like any other API key or password.
For applications like mobile or desktop apps where embedding a token may seem necessary, please contact our support team first. We will help you find a secure setup for your use case.
Last updated
Was this helpful?