Allowlists
Allowlists protect your project from undesirable activity.
Allowlist types restrict access to specific addresses, HTTP headers
User-Agent and Origin, and API request methods.Add the restriction details in the ALLOWLISTS section of your project's security settings.
Allowlists in Infura project security settings
- If a project has no allowlists, all requests are accepted.
- As soon as a project has an allowlist definition, all requests must pass it.
- Each project has a maximum of 30 allowlist entries per type.
- Each allowlist type is "AND"ed together.
- Multiple entries of the same type are "OR"ed.
If your application only queries data from specific Ethereum smart contracts or addresses, add those addresses to the CONTRACT ADDRESSES allowlist.
Any requests which query addresses that are not in the allowlist are rejected.
The following RPC methods take an Ethereum address parameter and are compatible with this type of allowlisting.
eth_calleth_estimateGaseth_getLogseth_getBalanceeth_getCodeeth_getStorageAteth_getTransactionCount
To allow a specific Ethereum address, click ADD and input it into the CONTRACT ADDRESSES allowlist.
Add an address to the allowlist
Test with a method from the list.
curl https://mainnet.infura.io/v3/<PROJECT_ID> \-H 'Content-Type: application/json' \-X POST \-d '{"id":1, "jsonrpc": "2.0", "method": "eth_getBalance","params":["0xfe05a3e72235c9f92fd9f2282f41a8154d6d342b", "latest"]}'
Result:
{"jsonrpc":"2.0","id":1,"result":"0x0"}
To limit access to your application to specific user agents, add them to the USER AGENTS allowlist.
When you add a User-Agent to an allowlist, any API requests originating from other platforms are rejected.
The USER AGENTS allowlist utilizes partial string matching. If the allowlisted string is present in the request's full User-Agent, it is registered as a match.
For example, to allow requests from Android phones alone, click ADD and input
Android into the USER AGENTS allowlist. 
Android added to USER AGENTS allowlist
Test with a simple call from a desktop terminal.
curl https://mainnet.infura.io/v3/<PROJECT_ID> \-X POST \-H "Content-Type: application/json" \-d '{"jsonrpc":"2.0","method":"eth_accounts","params":[],"id":1}'
Result:
{"jsonrpc":"2.0","error":{"code":-32002,"message":"rejected due to project ID settings"}}ash
To limit access to your application to specific URLs, add them to the ORIGINS allowlist.
When you add an origin to an allowlist, any API requests originating from other origins are rejected.
Origin allowlists support wildcard subdomain patterns.
For example, allowlist entry
https://*.example.com matches https://your-app.example.com , https://our-app.example.com, and https://their-app.example.com, etc.The origin scheme (HTTPS in the example above) is optional. However, if you include it, it must match.
An entry with only a scheme allows requests coming from that scheme alone.
To limit requests to your hosted web3 application, click ADD and input
mydapp.example.com into the ORIGINS allowlist. Any requests that do not include
Origin: mydapp.example.com are rejected.To limit the methods allowed, add them to the API REQUEST METHOD allowlist.
If the list is not empty, any method calls not specified in the list are rejected.
Use the dropdown list to select a method.
Select API REQUEST METHOD from the dropdown list
- Whenever you can ensure the
PROJECT_SECRETwill not be exposed publicly, include it in your requests. - Use both the User-Agent or Origin allowlists wherever possible.
- Don't reuse a Project ID.
- Create a new Project ID for each application. This allows you to allowlist the contract addresses relevant to that application.
- Never expose your
PROJECT_SECRETin client-side code, such as Javascript imported into a webpage or iOS or Android apps. Use the other options for securing public Project IDs instead.
Last modified 10mo ago