> For the complete documentation index, see [llms.txt](https://docs.luganodes.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.luganodes.com/rpc/platform-guide/apps-endpoints-and-api-keys.md).

# Apps, endpoints and API keys

Create apps, manage their endpoints and keep keys under control

### Apps

An app is your unit of access. Each app has exactly one API key and is enabled for all supported chains at creation, giving you one endpoint per chain. Your first app is created automatically when you sign up.

An app is in one of three states:

| State    | Meaning                                                                                  |
| -------- | ---------------------------------------------------------------------------------------- |
| Active   | Serves traffic and counts toward your plan's active app limit                            |
| Disabled | Stops serving traffic, does not count toward the limit, can be enabled again at any time |
| Deleted  | Permanent. The API key is revoked and cannot be restored                                 |

Only active apps count toward your plan limit (Free 3, Growth 20, Pro unlimited), so you can keep more apps than the limit as long as enough are disabled.

### Creating apps

Select **Create New App** from the dashboard and give it a name. The app is enabled for all chains and its endpoints are live immediately. You can verify any endpoint with **Test your endpoint** on the app page.

If you are at your plan's active app limit, creating a new app is blocked until you disable an existing app or upgrade. The **Create New App** button stays visible and explains both options.

### Endpoints

Each app exposes one endpoint per chain, with the API key in the URL:

```
https://ethereum-mainnet.rpc.luganodes.com/v1/<API_KEY>
https://ethereum-beacon-mainnet.rpc.luganodes.com/v1/<API_KEY>
https://bitcoin-mainnet.rpc.luganodes.com/v1/<API_KEY>
https://tron-mainnet.rpc.luganodes.com/v1/<API_KEY>
```

An endpoint serves traffic when three things are true: the app is active, the organization's billing is in good standing, and the organization is within its active app limit. If your endpoints stop responding, the dashboard shows which of these is the cause. See [plan changes and overage](/rpc/billing-and-plans/plan-changes-and-overage.md) for how billing state affects endpoints.

### API keys

The API key is a long lived credential embedded in the endpoint URL. It is not a show once secret: you can view it again at any time from the app page. For security, keys never appear in app lists, and every reveal is recorded in the audit log.

**Rotation:** Rotating a key issues a new secret and revokes the old one immediately, propagating to the gateway within seconds. Update your services with the new endpoint URL before rotating, or expect a brief interruption on that app.

Who can do what with keys depends on organization roles. Owners and Admins manage apps and keys, Viewers can see endpoints and keys for apps they can access, and the Billing role never sees endpoint URLs or keys. See [teams, members and roles](/rpc/platform-guide/teams-members-and-roles.md).

### Security and access controls

Because the key is embedded in the URL, per app restrictions are your primary defense if a key leaks. Each app has four controls, configured under **Security and access** in the app settings:

<table><thead><tr><th width="146.56640625">Control</th><th width="189.51171875">Use for</th><th>Effect</th></tr></thead><tbody><tr><td>Domain whitelist</td><td>Browser apps</td><td>Browser based requests are accepted only from the listed origins</td></tr><tr><td>Allowed IP addresses</td><td>Backend services</td><td>Requests are accepted only from the listed IPs or CIDR ranges</td></tr><tr><td>Allowed methods</td><td>Limiting key scope</td><td>The key can call only the listed JSON-RPC methods. Empty allows all methods in your plan tier</td></tr><tr><td>Daily CU limit</td><td>Protecting your monthly allowance</td><td>Caps the compute units this app can consume per day, so one app cannot burn the organization's monthly allowance. Requests over the limit are rejected until the counter resets at 00:00 UTC</td></tr><tr><td>Per app RPS cap</td><td>Protecting throughput</td><td>Caps this app's requests per second so one app cannot use the whole organization's throughput budget. Must be at or below your plan limit</td></tr></tbody></table>

With no restrictions configured, the key works from anywhere, can call any method in your plan tier, and shares the organization's plan budget. Requests blocked by an access control receive HTTP 403, and changes take effect within seconds of saving. If you lock yourself out by excluding your own origin or IP, edit or clear the list from the app page. If you suspect a leak, rotate the key first, then tighten the restrictions. See Security for key handling best practices.

{% hint style="info" %}
Treat the full endpoint URL as a secret. Anyone holding it can spend your compute units until the key is rotated or blocked by an allowlist.
{% endhint %}