> For the complete documentation index, see [llms.txt](https://docs.triton.one/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.triton.one/security/authentication.md).

# Auth and security

Send requests with a secret token or from an allowed origin, and respond if a token leaks.

|                                                                     | Secret token                         | Allowed origin                          |
| ------------------------------------------------------------------- | ------------------------------------ | --------------------------------------- |
| **Use from**                                                        | Servers, scripts, bots, gRPC clients | Browser apps                            |
| **Sent as**                                                         | URL path or `x-token` header         | Nothing. The browser sends its `Origin` |
| [**Rate tier**](/using-your-endpoint/rate-and-connection-limits.md) | Your token's tier                    | Your endpoint's tier                    |

## Secret tokens (backend)

{% hint style="danger" %}
Never put a token in frontend code. Anyone who can read it can use it from any origin, and the requests count against your account.
{% endhint %}

{% tabs %}
{% tab title="URL path" %}
JSON-RPC and WebSocket:

```url
https://<your-endpoint>.mainnet.rpcpool.com/<your-token>
wss://<your-endpoint>.mainnet.rpcpool.com/<your-token>
```

For gRPC, use the `x-token` header.
{% endtab %}

{% tab title="x-token header" %}
JSON-RPC, WebSocket and gRPC:

```bash
curl "https://<your-endpoint>.mainnet.rpcpool.com" \
  -H "X-Token: <your-token>" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"getSlot"}'
```

On WebSocket and gRPC, send the same `x-token` header (gRPC metadata).
{% endtab %}
{% endtabs %}

`<your-endpoint>` is your endpoint name, the first part of your hostname. For other chains and networks, see [Endpoint hostnames](/using-your-endpoint/endpoints-regions-routing.md#endpoint-hostnames).

* A token works only on the network of its subscription.
* A token can't be limited to one origin, endpoint or method.

## Allowed origins (frontend)

Browser apps call the endpoint URL with no token, over `https://` or `wss://`:

```url
https://<your-endpoint>.mainnet.rpcpool.com
```

* If an endpoint has active allowed origins, Triton accepts a tokenless browser request only from those origins.
* If an endpoint has active allowed origins, a tokenless JSON-RPC request with no `Origin` header gets `403`.
* A listed hostname also allows its subdomains.
* An origin with a port, such as `https://app.example.com:3000`, doesn't match a hostname entry.
* Allowed origins apply only to the hostnames under **Hostname(s)** in the dashboard. City hostnames need a token.
* Tokenless requests that look like backend traffic can get `403`. See [Stricter filters on tokenless backend traffic](/security/privacy-and-security.md#stricter-filters-on-tokenless-backend-traffic).
* Tokenless `http://` requests get `403`. Use `https://` or `wss://`.
* Changes can take a few minutes to apply.

{% hint style="warning" %}
An allowed origin isn't a secret. A non-browser client can send any `Origin` header. Use a token for servers.
{% endhint %}

### Add an allowed origin

{% stepper %}
{% step %}
Open the [customer dashboard](https://customers.triton.one) and click the subscription.
{% endstep %}

{% step %}
Under **Endpoints**, click the hostname under **Hostname(s)**.
{% endstep %}

{% step %}
Under **Allowed origins**, click **Add origin**, then enter the hostname, for example `app.example.com`.
{% endstep %}

{% step %}
Click **Save**.
{% endstep %}
{% endstepper %}

| Entry                                  | Rule                                                                                             |
| -------------------------------------- | ------------------------------------------------------------------------------------------------ |
| `app.example.com`                      | Enter a bare hostname, without `https://` or a path.                                             |
| `chrome-extension://<extension-id>`    | For a Chrome extension, enter its full origin.                                                   |
| `moz-extension://`                     | A Firefox extension’s ID differs in each browser install, so one entry matches only one install. |
| `localhost`, `127.0.0.1`, `vercel.app` | Rejected. For Vercel, enter your full subdomain, such as `my-app.vercel.app`.                    |
| `*.example.com`                        | A wildcard entry never matches.                                                                  |

* An endpoint accepts up to 5 active origins by default. Contact support for more.
* To stop allowing a site, switch the toggle next to its origin off and click **Save**. Saved origins can't be deleted.

### `__blocked.rpcpool.com`

* Triton adds it when you turn on an endpoint that has no allowed origins.
* It allows no browser origin, so only requests with a token work.
* It counts toward the 5 active origins while it's active.
* An active endpoint needs at least one active origin. The dashboard won't save it with none.

## Endpoint hygiene

* **Use HTTPS.** Send every request to `https://` or `wss://`. A token sent over `http://` or `ws://` can be read on the network.
* **Turn off unused endpoints.** Use the endpoint's switch under **Endpoints** (pay-as-you-go accounts), or contact support.
* **Set low balance notifications.** Pay-as-you-go accounts: under **Billing**, turn on **Low balance notifications**, set a threshold and click **Save**. At zero balance, the organization is deactivated.
* **Check Metrics.** Look for unfamiliar methods, traffic at unusual hours and sudden bandwidth jumps.
* **Keep tokens out of logs.** Treat a token like a database password.
* **Use one token per environment.** Create separate production, staging and test tokens under **RPC / gRPC Tokens** (operator role).
* **Keep `dev` out of token names.** **Metrics** doesn’t list a token whose name contains `dev`.

## If a token leaks

{% stepper %}
{% step %}

### Replace the token

Creating, deactivating and deleting tokens needs the operator role. Otherwise, contact support from the dashboard chat.

In the [customer dashboard](https://customers.triton.one), open the subscription. Under **Create new token**, enter a **Display Name**, choose a **Rate limit** and click **Add Token**. Update your services to use the new token.

* If the dashboard says `Please disable an existing token to create a new one`, your organization has a token limit. Deactivate a token you don't need, or contact support.
  {% endstep %}

{% step %}

### Check usage

Open **Metrics** and choose the leaked token in the resource dropdown. Look for traffic spikes or unfamiliar methods since the suspected leak.

* Check usage before you delete the token. Metrics doesn’t show a deleted token or its past traffic.
* A deactivated token can’t be chosen in the resource dropdown.
  {% endstep %}

{% step %}

### Delete the leaked token

Click the trash icon on the leaked token, then confirm **Delete**.

* Delete can't be undone. To keep the token, switch its toggle off and confirm instead. The reason is optional.
* A deleted or deactivated token can take a few minutes to stop working.
  {% endstep %}

{% step %}

### Search for the token

Search all repositories, config files, CI/CD pipelines and environment files for the token string. Triton tokens are UUIDs with no prefix, so don't rely on GitHub secret scanning to find them.
{% endstep %}

{% step %}

### Review allowed origins

Deactivate origins you don't recognise or that are broader than you need. A hostname also allows its subdomains.
{% endstep %}

{% step %}

### Rotate related credentials

Replace any token reused across environments, and any secret stored alongside the leaked token.
{% endstep %}
{% endstepper %}

## Proxying

Contact support before you put a proxy in front of an endpoint. See [Proxying](/using-your-endpoint/proxying.md).

## Report a security issue

<security@triton.one>

## What's next

<table data-card-size="large" data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><i class="fa-laptop">:laptop:</i> <strong>Customer dashboard tour</strong></td><td>Find your endpoint and token, check usage, and top up your balance.</td><td><a href="/account-and-billing/platform-overview.md">Customer dashboard tour</a></td></tr><tr><td><i class="fa-gauge">:gauge:</i> <strong>Rate and connection limits</strong></td><td>Per-IP rate and connection limits, and 429 handling.</td><td><a href="/using-your-endpoint/rate-and-connection-limits.md">Rate and connection limits</a></td></tr><tr><td><i class="fa-shield-halved">:shield-halved:</i> <strong>Privacy and data protection</strong></td><td>Triton's defence-in-depth security model and how your data is protected.</td><td><a href="/security/privacy-and-security.md">Privacy and data protection</a></td></tr></tbody></table>

***

<i class="fa-life-ring">:life-ring:</i> Contact support by clicking the chat icon in your [customer dashboard](https://customers.triton.one)\ <i class="fa-briefcase">:briefcase:</i> Sales questions? [Contact us](https://triton.one/contact)\ <i class="fa-sparkles">:sparkles:</i> AI agent? Read [llms.txt](https://docs.triton.one/llms.txt)\ <i class="fa-rss">:rss:</i> Follow updates: [Blog](https://blog.triton.one) · [X](https://x.com/triton_one) · [YouTube](https://www.youtube.com/@triton_one_ltd) · [Telegram](https://t.me/tritonone) · [GitHub](https://github.com/rpcpool)