API Key Security Alert: Exposed API keys can lead to unauthorized usage, quota exhaustion, and unexpected charges. Always protect your keys in production applications.

​
Why Key Protection Matters

When you expose API keys on the client side, malicious actors can discover and abuse them, potentially:

Exhaust Your Quota

Malicious usage can quickly consume your API limits and cause service interruptions

Increase Your Bills

Unauthorized requests can trigger auto-scaling charges or push you over plan limits

Compromise Security

Exposed keys can provide access to sensitive data and operations

Damage Performance

High unauthorized usage can impact your application’s performance

​
Protection Methods

Helius provides multiple layers of protection to secure your API keys:
Deploy your own proxy for maximum security and control.

Helius RPC Proxy

A simple, open-source RPC proxy that you can deploy with 1-click to Cloudflare.

​
Benefits of Using a Proxy

Complete Key Protection

Your API key stays server-side, never exposed to clients

Custom Rate Limiting

Implement your own rate limiting and usage controls

Request Filtering

Filter and validate requests before they reach Helius

Usage Analytics

Monitor and analyze your API usage patterns

​
Best Practices

Environment Variables

Never hardcode API keys in your source code. Use environment variables instead.
// ❌ Don't do this
const apiKey = "your-api-key-here";

// ✅ Do this instead
const apiKey = process.env.HELIUS_API_KEY;

Separate Keys for Different Environments

Use different API keys for development, staging, and production environments.
const getApiKey = () => {
  switch (process.env.NODE_ENV) {
    case 'production':
      return process.env.HELIUS_API_KEY_PROD;
    case 'staging':
      return process.env.HELIUS_API_KEY_STAGING;
    default:
      return process.env.HELIUS_API_KEY_DEV;
  }
};

Regular Key Rotation

Rotate your API keys regularly and immediately if you suspect they’ve been compromised.
1

Generate New Key

Create a new API key in your Helius dashboard
2

Update Applications

Update all applications to use the new key
3

Test Thoroughly

Ensure all services are working with the new key
4

Revoke Old Key

Delete the old key from your dashboard

Monitor Usage

Regularly check your API usage in the Helius dashboard for unusual patterns.Red flags to watch for:
  • Sudden spikes in usage
  • Requests from unexpected locations
  • High error rates
  • Usage during off-hours

​
Security Checklist

​
Common Mistakes to Avoid

Avoid these common security pitfalls:
  1. Hardcoding keys in frontend JavaScript - Always use secure URLs or proxies
  2. Committing keys to Git repositories - Use environment variables and .gitignore
  3. Using production keys for development - Separate keys for different environments
  4. Not setting access control rules - Always configure domain/IP restrictions
  5. Ignoring unusual usage patterns - Monitor your dashboard regularly

​
Need Help?

Discord Community

Get help from the community and Helius team

Support Team

Contact our support team for security concerns