Public API
Overview
The Public API is a signed HTTPS JSON interface for merchants’ servers. Create payments and get a paid event (with a free AML result), watch addresses and transactions, receive block events, manage RPC endpoints, and read your plan, usage, and network prices. Events reach you over HTTP webhooks or a WebSocket — each is a separate transport with its own settings. JSON-RPC traffic itself goes to each endpoint URL, not through this API.
Base URL
The host is https://api.rpcnode.dev and every route starts with /v1, for example GET /v1/account — the full address is https://api.rpcnode.dev/v1/account.
The path you sign starts with /v1/… (see Authentication).
Base and a few routes
https://api.rpcnode.dev/v1
GET https://api.rpcnode.dev/v1/account
GET https://api.rpcnode.dev/v1/networks
POST https://api.rpcnode.dev/v1/payments
GET https://api.rpcnode.dev/v1/address-watches
PUT https://api.rpcnode.dev/v1/webhooksCreate an API key
Open the connect dashboard → API keys (/app/api-keys) and create a key.
You receive a UUID for the X-Api-Key header and a secret (sk_live_…) shown once — store it securely. The secret signs every request and cannot be recovered later. The cabinet list shows only the secret prefix.
The same UUID is the application key of the WebSocket connection (see WebSockets). Optional per-key IP allowlist: requests from other client IPs receive 403.
Authentication
Every request must include X-Api-Key, X-Timestamp, and X-Signature. The signature covers the method, the path with its query string, and the body.
Response and error shape
Successful responses are JSON with ok: true and the fields of the method. A field that has no value is not written (it is not sent as null): read a missing field as "no value".
Failures use ok: false, a stable error_code, and a message in error. A request body that cannot be accepted gets 400 with errors — a list with every field that is wrong, not only the first. IDs of resources are UUIDs (an endpoint has a uuid, a watch has a watch_id, a payment has a payment_id); numeric ids are never shown or accepted.
Error example
{
"ok": false,
"error_code": "public_api.signature_invalid",
"error": "Invalid signature."
}Rate limits
Per client address: 30 requests per second. Per account: 100 requests per minute for all its keys together, on every plan. Failed sign-ins: 20 per minute per address, then the address waits for the next minute. Over a limit the answer is 429 with Retry-After.
These limits are separate from the JSON-RPC rps_limit of your plan.
What you can do
Payments — create a payment, list it, read it by id or by your order id, cancel it; a paid event follows over webhook or WebSocket.
Account — your plan with its limits and what is used (GET /v1/account), and credits by day (GET /v1/usage).
Networks — the networks, the credit price of webhooks and blocks, RPC methods and their prices, network status, and tokens you can accept.
Endpoints — list and create JSON-RPC endpoints, read their usage, switch them on or off, set allowed IPs.
Address Watch — watch addresses and read their events.
Transaction watch — watch a transaction hash until it is confirmed.
Webhooks — the URL, the secret, the event types and networks, a test delivery, and the delivery log.
WebSockets — the same events over a Pusher-compatible socket, and its subscription settings.
Block events — a new block of a network, by webhook or by socket.
İpuçları
- Events are delivered by two separate transports. A webhook and a WebSocket are enabled and configured independently; an event wanted by both is delivered, and charged, twice.
- JSON-RPC full-node calls use each endpoint’s URL (a UUID) — do not send X-Api-Key / X-Signature there.
- An empty request body is allowed (GET); the signature still hashes the empty body.
- Address slots and the number of endpoints are plan limits (see Account).