Authentication

Mechanisms

• Key in path. /v1/$KEY. Simplest, and fine server side.
• Bearer token. Authorization: Bearer $TOKEN. Keeps the secret out of URLs, proxy logs and referrer headers.
• Signed JWT. Short TTL tokens signed with your account key, for browser and agent clients that must not hold a long-lived secret.
• IP allowlist. CIDR ranges enforced at the edge, before a request reaches a node.

# key in path
curl https://rpc.arcrpc.com/v1/$KEY \
  -d '{"jsonrpc":"2.0","id":1,"method":"eth_chainId","params":[]}'

# bearer token, same endpoint, secret stays out of the URL
curl https://rpc.arcrpc.com/v1 \
  -H "authorization: Bearer $TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"eth_chainId","params":[]}'

Scoping

A key is scoped by network, by method namespace and by residency policy. A read-only key for a public frontend can carry eth_* and arcrpc_getUsdcBalance and nothing else, so a leaked key cannot submit a transaction or drain the allowance with trace_filter.

Rotation

Create the replacement, deploy it, retire the old key. Both are valid during the overlap and rotation is never billed. If a key leaks, mail [email protected] and we revoke immediately.