Skip to main content
Open Endpoints and keep the Endpoints tab selected to create RPC and WebSocket credentials for one access, network, and location. Token & Endpoints then shows the selected location’s token and connection details.

​
Before you start

You need an owned pass or active rental under the Discord account. Decide which deployment location the credential will serve. If you plan to restrict the token, identify the server’s stable public egress IPv4 address. You can add the restriction after the endpoint works.

​
Generate a location token

1

Open the endpoint panel

Open Endpoints in the sidebar and select the Endpoints tab.
2

Select the access

Choose the pass or rental your application should consume. Product and location options are scoped to this access.
3

Select the network and location

Under Node access, select a Network and Location. A dot beside a location indicates that it already has an active token.
4

Generate the token

Under Token & Endpoints — location, choose Generate token for location.The panel shows a masked location token, the RPC and WS URLs, and any streaming targets for the selected access and location.
5

Copy the secure URL

Copy the RPC or WS value from the SSL column. Store the complete URL as a secret and use it without rebuilding the hostname or token path.
Each location has an independent token. A token copied for one location does not authenticate another location, and rotating one does not alter the others.

​
Verify an RPC endpoint

Set the complete SSL RPC URL in your terminal:
Send one request:
Representative output:
The endpoint works when the response contains result.value.blockhash. A JSON-RPC error object or non-2xx HTTP response is a failure even if a body is returned.

​
Restrict the token to one IPv4 address

The restriction applies to RPC and WebSocket traffic authenticated by the selected location token.
1

Confirm the public egress address

Determine the single public IPv4 address ThorNode sees after your server’s NAT, gateway, VPN, or proxy. Do not use a private interface address.
2

Save the restriction

Enter the address under Restrict to IP — location (optional) and choose Save restriction.Enter the server’s real, globally routable public egress IPv4 address. The field does not accept a hostname, URL, port, CIDR range, IPv6 address, or address list.
3

Test from the deployment

Repeat the RPC test from the allowed server. The request should succeed there and fail authentication from another public address.
Leave the field blank and choose Save restriction to remove the restriction. Keep it blank for deployments with changing public egress addresses.

​
Regenerate or revoke a token

Choose Regenerate when the deployment still needs the location but the secret may be exposed. Choose Revoke when the deployment no longer needs the location credential.
Regeneration invalidates the current location token immediately. Revoke leaves that location with no working token. Identify every dependent service before confirming either action; other locations are unaffected.
After regeneration, replace the secret in every dependent service and repeat the verification request. After revocation, the selected location returns to No token yet for location. Neither action deletes the pass or rental.

​
Diagnose a failed endpoint

​
Next steps