AIFor agents: /use-cases/lock-it-down.llms.txt

Lock it down

An open RPC endpoint gets discovered fast — and someone else's bot ends up spending your provider budget. eRPC puts real access control in front: API keys for your services, JWTs or Sign-in-with-Ethereum for your users, network allowlists for your infra, and per-user rate budgets so no single consumer can starve the rest. Browsers can talk to it directly, under CORS rules you control.

AuthenticationSecrets, JWT, Sign-in-with-Ethereum, and IP allowlists.Rate limitersBudgets that protect providers, projects, and fairness between users.CORSServe browsers directly on your own origin rules.Admin APIOperational controls behind their own separate auth.

All of the above in one place — illustrative, not a tuned production config:

(root)

erpc.yaml

rateLimiters:  # a reusable budget: fairness between consumers  budgets:    - id: per-user      rules:        - method: "*"          maxCount: 200          period: 1sprojects:  - id: main    # serve browsers directly, on your own origin rules    cors:      allowedOrigins: ["https://app.example.com"]      allowCredentials: false    auth:      strategies:        # API keys for your services, throttled by the budget above        - type: secret          rateLimitBudget: per-user          secret:            value: ${MY_API_KEY}        # infra allowlist: no key needed inside your network        - type: network          network:            allowedCIDRs: ["10.0.0.0/8"]            allowLocalhost: true# Admin API auth is separate: admin.auth (same strategy types).

Agent reference

Copy one of these prompts into your AI agent session (Claude Code, Cursor, …) — each one points the agent at this page's machine-readable reference so it can do the work correctly:

Prompt Example #1: add API-key auth and per-user rate limits

My eRPC endpoint is wide open and I need to lock it down with API keys and per-user
rate budgets so no single consumer can exhaust my provider quota. Update my eRPC config
with authentication strategies and fair-use limits. Read the full reference first:
https://docs.erpc.cloud/use-cases/lock-it-down.llms.txt

Prompt Example #2: enable CORS for browser clients and configure JWT auth

I want my frontend app to call eRPC directly from the browser using JWT tokens
issued by my auth service. Configure CORS and JWT strategy in my eRPC config so only
my domain can make requests and tokens are validated properly. Reference:
https://docs.erpc.cloud/use-cases/lock-it-down.llms.txt

Prompt Example #3: audit auth and rate-limit config for gaps

Review the auth and rate-limiter setup in my eRPC config for security gaps —
missing IP allowlist coverage, missing method-level rate rules, or strategies without
budgets. Suggest hardening steps. Reference:
https://docs.erpc.cloud/use-cases/lock-it-down.llms.txt

Lock it down — agent starting pointsExpand for every option, default, and edge case — or copy this entire section into your AI assistant.

This page sells the outcome; implementation lives in the feature pages. Fetch their machine-readable companions:

Authentication — every strategy (secret, jwt, siwe, network, database) with full per-strategy config.
Rate limiters — budgets, per-method rules, auto-tuner behavior and footguns.
CORS — matching semantics and preflight behavior.
Admin API — admin-scoped auth and every endpoint.

Composition notes: auth strategies attach per project (and separately for admin); each strategy can carry its own rateLimitBudget, so per-user fairness is an auth-level concern while provider protection is an upstream-level budget. Exact fields and defaults live in each page's agent section.

Trust the data See everything