Apps, endpoints and API keys
Create apps, manage their endpoints and keep keys under control
Apps
An app is your unit of access. Each app has exactly one API key and is enabled for all supported chains at creation, giving you one endpoint per chain. Your first app is created automatically when you sign up.
An app is in one of three states:
Active
Serves traffic and counts toward your plan's active app limit
Disabled
Stops serving traffic, does not count toward the limit, can be enabled again at any time
Deleted
Permanent. The API key is revoked and cannot be restored
Only active apps count toward your plan limit (Free 3, Growth 20, Pro unlimited), so you can keep more apps than the limit as long as enough are disabled.
Creating apps
Select Create New App from the dashboard and give it a name. The app is enabled for all chains and its endpoints are live immediately. You can verify any endpoint with Test your endpoint on the app page.
If you are at your plan's active app limit, creating a new app is blocked until you disable an existing app or upgrade. The Create New App button stays visible and explains both options.
Endpoints
Each app exposes one endpoint per chain, with the API key in the URL:
https://ethereum-mainnet.rpc.luganodes.com/v1/<API_KEY>
https://ethereum-beacon-mainnet.rpc.luganodes.com/v1/<API_KEY>
https://bitcoin-mainnet.rpc.luganodes.com/v1/<API_KEY>
https://tron-mainnet.rpc.luganodes.com/v1/<API_KEY>An endpoint serves traffic when three things are true: the app is active, the organization's billing is in good standing, and the organization is within its active app limit. If your endpoints stop responding, the dashboard shows which of these is the cause. See plan changes and overage for how billing state affects endpoints.
API keys
The API key is a long lived credential embedded in the endpoint URL. It is not a show once secret: you can view it again at any time from the app page. For security, keys never appear in app lists, and every reveal is recorded in the audit log.
Rotation: Rotating a key issues a new secret and revokes the old one immediately, propagating to the gateway within seconds. Update your services with the new endpoint URL before rotating, or expect a brief interruption on that app.
Who can do what with keys depends on organization roles. Owners and Admins manage apps and keys, Viewers can see endpoints and keys for apps they can access, and the Billing role never sees endpoint URLs or keys. See teams, members and roles.
Security and access controls
Because the key is embedded in the URL, per app restrictions are your primary defense if a key leaks. Each app has four controls, configured under Security and access in the app settings:
Domain whitelist
Browser apps
Browser based requests are accepted only from the listed origins
Allowed IP addresses
Backend services
Requests are accepted only from the listed IPs or CIDR ranges
Allowed methods
Limiting key scope
The key can call only the listed JSON-RPC methods. Empty allows all methods in your plan tier
Daily CU limit
Protecting your monthly allowance
Caps the compute units this app can consume per day, so one app cannot burn the organization's monthly allowance. Requests over the limit are rejected until the counter resets at 00:00 UTC
Per app RPS cap
Protecting throughput
Caps this app's requests per second so one app cannot use the whole organization's throughput budget. Must be at or below your plan limit
With no restrictions configured, the key works from anywhere, can call any method in your plan tier, and shares the organization's plan budget. Requests blocked by an access control receive HTTP 403, and changes take effect within seconds of saving. If you lock yourself out by excluding your own origin or IP, edit or clear the list from the app page. If you suspect a leak, rotate the key first, then tighten the restrictions. See Security for key handling best practices.
Last updated