Authentication
Project IDs, project secrets and the three ways to send a secret.
Preview: Swop RPC is not generally available
The gateway at rpc.swopme.co is running, but it routes to third-party node providers today: Swop's own node fleet is still being built. Projects are created for preview partners only, and limits and pricing can change. Request access.
Project ID
The project ID is part of the URL. It identifies your project for limits and metering. On its own it isn't a secret: anyone who sees your URL can see it.
Project secret
A project can require a secret. When it does, every request must include it, or the gateway rejects it. Send it one of three ways, in this order of preference:
| Method | Example | Use when |
|---|---|---|
| Header | x-project-secret: YOUR_PROJECT_SECRET | Servers and any client that can set headers. |
| Basic auth | Authorization: Basic base64(projectId:secret) | Tools that only support a URL with credentials. The username must be your project ID. |
| Query parameter | ?projectSecret=YOUR_PROJECT_SECRET | WebSockets and clients that can't set headers. The secret ends up in URLs and logs, so rotate it more often. |
Never ship a secret in a web or mobile app
Anything in a browser bundle or app binary is public. For client apps, use a separate project with tight rate limits, or call the RPC from your backend.
Rotating a secret
Secrets can be rotated. After rotation the old secret stops working, so update your servers first, then rotate.