> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thornode.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create and manage endpoints

> Generate a location-scoped token, copy SSL RPC and WebSocket URLs, add one IPv4 restriction, and rotate or revoke the token.

Open **Endpoints** and keep the **Endpoints** tab selected to create RPC and WebSocket credentials for one access, network, and location. **Token & Endpoints** then shows the selected location's token and connection details.

## Before you start

You need an owned pass or active rental under the Discord account. Decide which deployment location the credential will serve.

If you plan to restrict the token, identify the server's stable public egress IPv4 address. You can add the restriction after the endpoint works.

## Generate a location token

<Steps>
  <Step title="Open the endpoint panel">
    Open **Endpoints** in the sidebar and select the **Endpoints** tab.
  </Step>

  <Step title="Select the access">
    Choose the pass or rental your application should consume. Product and location options are scoped to this access.
  </Step>

  <Step title="Select the network and location">
    Under **Node access**, select a **Network** and **Location**. A dot beside a location indicates that it already has an active token.
  </Step>

  <Step title="Generate the token">
    Under **Token & Endpoints — *location***, choose **Generate token for *location***.

    The panel shows a masked location token, the **RPC** and **WS** URLs, and any
    streaming targets for the selected access and location.
  </Step>

  <Step title="Copy the secure URL">
    Copy the **RPC** or **WS** value from the **SSL** column. Store the complete URL as a secret and use it without rebuilding the hostname or token path.
  </Step>
</Steps>

Each location has an independent token. A token copied for one location does not authenticate another location, and rotating one does not alter the others.

## Verify an RPC endpoint

Set the complete SSL RPC URL in your terminal:

```bash theme={null}
export THORNODE_RPC_URL='<full SSL RPC URL copied from Endpoints>'
```

Send one request:

```bash theme={null}
curl --fail-with-body --request POST "$THORNODE_RPC_URL" \
  --header 'content-type: application/json' \
  --data '{"jsonrpc":"2.0","id":1,"method":"getLatestBlockhash"}'
```

Representative output:

```text theme={null}
{"jsonrpc":"2.0","result":{"context":{"slot":...},"value":{"blockhash":"...","lastValidBlockHeight":...}},"id":1}
```

The endpoint works when the response contains `result.value.blockhash`. A JSON-RPC `error` object or non-2xx HTTP response is a failure even if a body is returned.

## Restrict the token to one IPv4 address

The restriction applies to RPC and WebSocket traffic authenticated by the selected location token.

<Steps>
  <Step title="Confirm the public egress address">
    Determine the single public IPv4 address ThorNode sees after your server's NAT, gateway, VPN, or proxy. Do not use a private interface address.
  </Step>

  <Step title="Save the restriction">
    Enter the address under **Restrict to IP — *location* (optional)** and choose **Save restriction**.

    Enter the server's real, globally routable public egress IPv4 address. The
    field does not accept a hostname, URL, port, CIDR range, IPv6 address, or
    address list.
  </Step>

  <Step title="Test from the deployment">
    Repeat the RPC test from the allowed server. The request should succeed there and fail authentication from another public address.
  </Step>
</Steps>

Leave the field blank and choose **Save restriction** to remove the restriction. Keep it blank for deployments with changing public egress addresses.

## Regenerate or revoke a token

Choose **Regenerate** when the deployment still needs the location but the secret may be exposed. Choose **Revoke** when the deployment no longer needs the location credential.

<Warning>
  Regeneration invalidates the current location token immediately. Revoke leaves
  that location with no working token. Identify every dependent service before
  confirming either action; other locations are unaffected.
</Warning>

After regeneration, replace the secret in every dependent service and repeat the verification request. After revocation, the selected location returns to **No token yet for *location***. Neither action deletes the pass or rental.

## Diagnose a failed endpoint

| Symptom                          | Verify                                                               | Expected result                                           | Action                                                                                       |
| -------------------------------- | -------------------------------------------------------------------- | --------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| `401` or `403`                   | Access, network, location, copied URL, and optional IPv4 restriction | All values refer to the same selected location            | Recopy the URL or correct the restriction; regenerate only if the secret is stale or exposed |
| `429`                            | **Usage** and **Limits** for the selected access                     | Traffic remains within the live rate or concurrency limit | Reduce concurrency and retry transient requests with bounded backoff                         |
| RPC works but WebSocket does not | The copied row and column                                            | The client uses the **WS** value under **SSL**            | Recopy the WSS URL and check proxy or firewall WebSocket support                             |
| Another location works           | The failing location's own token and status                          | Each location has its own valid token                     | Debug the failing location without rotating the healthy token                                |

## Next steps

* [Connect a production RPC or WebSocket client](/products/thoredge-rpc).
* [Monitor the token's usage and limits](/dashboard/usage-and-limits).
* [Store and rotate secrets safely](/reference/security).