> ## Documentation Index
> Fetch the complete documentation index at: https://www.helius.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Securing Your Key

> Lock down the Helius API key your embedded-wallet app exposes in the browser — access control, Secure RPC URLs, the server route handler, and a one-click Cloudflare proxy

The wallet-kit SDK runs in the browser, so your Helius `apiKey` is present client-side: the provider passes it to the wallet **bootstrap** (`/waas/config`) when your app loads. This is expected for a client-side SDK — the job is to make sure the exposed key can't be abused.

<Note>
  **Exposure is not a billing bypass.** Every signature is metered at the moment
  the embedded wallet signs, not at the API-key layer. A leaked key that's
  locked to your domains can't be used to mint free signatures or run up your
  credits from someone else's site; the metering doesn't depend on key secrecy.
</Note>

Work down this list — the first step is the required baseline; the rest add defense in depth.

## 1. Domain-restrict your key (required)

Lock the key to the origins your app runs on. Once set, requests from any other origin are rejected, so a key scraped out of your bundle is useless anywhere but your own domains.

<Steps>
  <Step title="Open RPC Access Control">
    In the [dashboard](https://dashboard.helius.dev), go to your key under the
    **RPCs** section and open **Access Control**.
  </Step>

  <Step title="Add your domains to Allowed Domains">
    Add every origin your app serves from — production, staging, and preview:

    ```
    yourdapp.com
    www.yourdapp.com
    staging.yourdapp.com
    ```
  </Step>

  <Step title="Use a separate key per environment">
    Keep a distinct key for local, staging, and production so you can rotate one
    without taking down the others.
  </Step>
</Steps>

See [Protect your keys](/docs/rpc/protect-your-keys) for the full set of access-control
rules (allowed IPs and CIDR ranges for server-side keys).

## 2. Secure RPC URLs (automatic)

For RPC traffic, the SDK resolves your project's **key-less Secure RPC URLs** at
bootstrap and uses them for `connection` calls — so your API key never rides
along on RPC requests. There's nothing to configure; it's on by default.

<Info>
  Secure URLs are rate-limited to 5 RPS per IP and are available on paid plans.
</Info>

## 3. Move traffic server-side with the route handler

The SDK ships a Next.js route handler that forwards your RPC, send, and
transaction-history calls through your own server, injecting the key from a
**server-side** env var (`HELIUS_API_KEY`) so it's never in those requests. This
is also how you opt into [Sender-optimized landing](/docs/sending-transactions/sender)
and transaction history.

```ts app/api/helius/[...path]/route.ts theme={"system"}
import { createHeliusRouteHandler } from "helius-wallet-kit/next";

export const { GET, POST } = createHeliusRouteHandler();
```

Set `HELIUS_API_KEY` as a server env var and the handler attaches it to the
forwarded requests. See [Quickstart → server route handler](/docs/waas/quickstart#setup).

<Note>
  The **bootstrap** still uses your client `apiKey`, as it's passed to the
  provider `config` and sent to `/waas/config` from the browser, so the key is
  present in the browser even with the route handler mounted. Domain-restricting
  the key (step 1) is what secures this call. Fully server-side key handling is
  on the roadmap.
</Note>

## 4. Self-host a Cloudflare RPC proxy

For maximum control, deploy your own proxy so the key stays entirely server-side
and you can add your own rate limiting and request filtering on top.

<Card title="Helius RPC Proxy" icon="github" href="https://github.com/helius-labs/helius-rpc-proxy">
  Open-source RPC proxy you can deploy to Cloudflare with one click.
</Card>

## Checklist

Before you ship:

* Client key is domain-restricted to your exact origins
* Separate keys for local / staging / production
* Key is read from an env var, never hardcoded
* (Optional) Route handler mounted for server-side RPC/send + Sender
* (Optional) Cloudflare proxy for full server-side key handling

## Next steps

<CardGroup cols={2}>
  <Card title="Protect your keys" icon="shield-halved" href="/docs/rpc/protect-your-keys">
    Full access-control reference: domains, IPs, CIDRs, and proxies.
  </Card>

  <Card title="Configuration" icon="sliders" href="/docs/waas/configuration">
    Provider config and dashboard sign-in methods.
  </Card>
</CardGroup>