This page collects, in one order, the xOneRS settings an RPC provider needs, with a link to the post that explains each. Everything here is on main after 2026-11-15; v0.1.0 has the older, fixed behaviour, and the per-post notes say which. Mainnet is not yet qualified for any role in the support matrix, so start on Apothem.

1. Which history must the node keep?

  • Recent state only (balances and calls near the head): a full node. Older state reads answer the typed unsupported history error, never an empty result.
  • State at any block: an archive node, --gcmode archive. See xOne archive mode and archive vs full for RPC providers.
  • Bodies, receipts and logs: keep the whole chain (the default) or set --history.bodies, --history.receipts and --history.logs. A snap-synced node can fetch older bodies and receipts with --history.bodies-from and --history.receipts-from. See history retention.
  • Tell clients what you hold: eth_capabilities reports the oldest block for state, transactions, logs, receipts and blocks. See newer RPC methods.

2. Which namespaces should the public listener serve?

The default is eth,net,web3. Add XDPoS if your users need consensus data (the XDPoS namespace). Keep admin, debug, perm, trace and ots off public listeners, or behind a per-key method list (step 4). See the debug namespace and trace_ and ots_ for explorers.

3. Which limits should I set?

  • Every request is bounded: batch size, body and response size, a per-class quota and deadline. See exposing RPC safely.
  • eth_getLogs and trace_filter: --rpc.rangelimit (default 5,000 blocks) and --rpc.logs.maxresults (default 10,000). Tell users about the retry hints in the overflow error. See eth_getLogs limits.
  • eth_call and eth_estimateGas: --rpc.gascap and --rpc.evmtimeout.

4. How do I secure it?

  • TLS on the node: --http.tls.cert, --http.tls.key, and client certificates with --http.tls.clientca if needed.
  • Per-key method lists: --rpc.jwtsecret plus --rpc.acl, mapping each token's sub to method patterns.
  • Both in TLS, client certificates and method ACLs. A reverse proxy is still useful for certificate renewal and billing-level rate limits.

5. One port or two?

Set --ws.addr/--ws.port equal to the HTTP pair to serve both on one port, with separate namespaces, origins and budgets. On a shared port, do not rely on admin_stopWS (issue #1143). See HTTP and WebSocket on one port.

6. How does the load balancer know a node is healthy?

Probe /readyz on the metrics port; send traffic to the RPC port. The head-age limit is --metrics.readyz.maxheadage (default 180 s, so one XDPoS timeout round does not mark every node down). See health checks.

7. What should I watch?

8. What do indexers on my endpoint need?

WebSocket subscriptions including newFinalizedHeads and txLifecycle, and for a data platform the Kafka exporter (check the broker version first, issue #1148). See streaming chain events.

Frequently asked questions

Should an XDC RPC provider run an archive node?

Only if users ask for state at old blocks. A full node answers recent state and refuses older reads with a typed error; an archive node answers all of them and needs more disk.

What is the default eth_getLogs block range on xOne?

5,000 blocks. Change it with --rpc.rangelimit.

How do I give different API keys different methods?

Use --rpc.jwtsecret and --rpc.acl, and issue each key a token whose sub names its entry in the ACL.

Which endpoint should my load balancer probe?

/readyz on the metrics port.

Sources