Skip to main content
The wallet-kit SDK runs in the browser, so your Helius apiKey is present client-side: the provider passes it to the wallet bootstrap (/waas/config) when your app loads. This is expected for a client-side SDK — the job is to make sure the exposed key can’t be abused.
Exposure is not a billing bypass. Every signature is metered at the moment the embedded wallet signs, not at the API-key layer. A leaked key that’s locked to your domains can’t be used to mint free signatures or run up your credits from someone else’s site; the metering doesn’t depend on key secrecy.
Work down this list — the first step is the required baseline; the rest add defense in depth.

​
1. Domain-restrict your key (required)

Lock the key to the origins your app runs on. Once set, requests from any other origin are rejected, so a key scraped out of your bundle is useless anywhere but your own domains.
1

Open RPC Access Control

In the dashboard, go to your key under the RPCs section and open Access Control.
2

Add your domains to Allowed Domains

Add every origin your app serves from — production, staging, and preview:
3

Use a separate key per environment

Keep a distinct key for local, staging, and production so you can rotate one without taking down the others.
See Protect your keys for the full set of access-control rules (allowed IPs and CIDR ranges for server-side keys).

​
2. Secure RPC URLs (automatic)

For RPC traffic, the SDK resolves your project’s key-less Secure RPC URLs at bootstrap and uses them for connection calls — so your API key never rides along on RPC requests. There’s nothing to configure; it’s on by default.
Secure URLs are rate-limited to 5 RPS per IP and are available on paid plans.

​
3. Move traffic server-side with the route handler

The SDK ships a Next.js route handler that forwards your RPC, send, and transaction-history calls through your own server, injecting the key from a server-side env var (HELIUS_API_KEY) so it’s never in those requests. This is also how you opt into Sender-optimized landing and transaction history.
app/api/helius/[...path]/route.ts
Set HELIUS_API_KEY as a server env var and the handler attaches it to the forwarded requests. See Quickstart → server route handler.
The bootstrap still uses your client apiKey, as it’s passed to the provider config and sent to /waas/config from the browser, so the key is present in the browser even with the route handler mounted. Domain-restricting the key (step 1) is what secures this call. Fully server-side key handling is on the roadmap.

​
4. Self-host a Cloudflare RPC proxy

For maximum control, deploy your own proxy so the key stays entirely server-side and you can add your own rate limiting and request filtering on top.

Helius RPC Proxy

Open-source RPC proxy you can deploy to Cloudflare with one click.

​
Checklist

Before you ship:
  • Client key is domain-restricted to your exact origins
  • Separate keys for local / staging / production
  • Key is read from an env var, never hardcoded
  • (Optional) Route handler mounted for server-side RPC/send + Sender
  • (Optional) Cloudflare proxy for full server-side key handling

​
Next steps

Protect your keys

Full access-control reference: domains, IPs, CIDRs, and proxies.

Configuration

Provider config and dashboard sign-in methods.