Honeycluster's public endpoints are unauthenticated. You can connect to
https://honeycluster.io (or the testnet / devnet subdomains) from any
client — including a browser — without providing any credentials. This
page exists to cover the cases where you do authenticate: dedicated
enterprise clusters, private endpoints, and the portal's account/tRPC
surface.
If you're only using the public cluster, you can skip most of this page. See Rate Limits for the shared-tier fair-use policy that applies to anonymous traffic.
You need an API key when:
Public rippled/Clio traffic never requires a key.
production-indexer), and copy the generated value.Keys are only shown once at creation time. If you lose the value, revoke the key and issue a new one.
TypeScriptconst response = await fetch('https://YOUR-PRIVATE-ENDPOINT.honeycluster.io', { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-API-Key': process.env.HONEYCLUSTER_API_KEY!, }, body: JSON.stringify({ method: 'ledger', params: [{ ledger_index: 85123456, transactions: true, expand: true }], }), }) const data = await response.json()
The body shape is the XRP Ledger's standard JSON-RPC envelope
(method + params: [{}]). Private endpoints accept the same methods
as the public cluster, just behind authentication.
In a Node runtime the X-API-Key header can ride along on the HTTP
upgrade request because Node's ws library lets you set arbitrary
headers. With xrpl.js:
TypeScriptimport { Client } from 'xrpl' const client = new Client('wss://YOUR-PRIVATE-ENDPOINT.honeycluster.io', { headers: { 'X-API-Key': process.env.HONEYCLUSTER_API_KEY! }, }) await client.connect()
Browsers cannot set custom WebSocket headers
The browser WebSocket API only accepts a URL and a subprotocol list —
there is no way to set X-API-Key on the opening handshake from
JavaScript running in a browser. This is a Web Platform restriction, not
a Honeycluster one.
If your private endpoint requires an API key and you also need browser
clients, proxy browser traffic through a backend you control. See
Proxying Requests for the pattern (and a real
example from the explorer app).
For the public honeycluster.io endpoint, this doesn't apply —
browsers can connect directly without any header.
Each key is tied to a single project. A project owns its own rate-limit tier and usage history. To isolate staging from production traffic, create two projects and issue one key per project — don't share a single key across environments.
API keys don't expire, but you should rotate them periodically:
Revoke immediately if a key leaks — revocation takes effect within seconds.
Never ship keys to the browser
API keys grant project-wide access and are not scoped per user. If you have a private endpoint that requires one, put the key behind your own backend and proxy frontend calls through it. See the Node.js proxy tutorial for a concrete example.