Celestia API authentication

Authentication depends on the service you call. Reading these docs, downloading the API specifications, and using the documentation MCP server do not require an account or API key. The documentation site does not register agents or issue credentials for node providers.

Node RPC tokens

The Celestia Node API listens on port 26658 by default and requires a JWT auth token on every request. Generate a token on the node that serves the API, using the node type and --p2p.network value of the running node:

celestia light auth admin --p2p.network mocha

auth admin grants every permission. Use auth read for read-only access or auth write to allow blob submission without node administration. Each run issues a new token. See get your auth token for the node setup around this command.

Send the token in the Authorization header as a bearer token:

curl -X POST http://localhost:26658 \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <auth_token>" \
  --data '{"jsonrpc":"2.0","id":1,"method":"node.Info","params":[]}'

The Go quickstart reads the same token from CELE_DA_TOKEN, and a consensus endpoint token from CELE_CORE_TOKEN. Keep tokens out of source control, shared request examples, and public bug reports.

Revoke a token on Mocha

On Mocha with celestia-node v0.35.0 or later, the admin-only node.AuthRevoke RPC method or celestia node revoke-token command revokes a single token:

celestia node revoke-token "$TOKEN_TO_REVOKE" --url http://localhost:26658 --token "$ADMIN_TOKEN"

Use an admin token for ADMIN_TOKEN. Revoked tokens stop authenticating, and their open WebSocket sessions and subscriptions are closed. Revocations persist across restarts. On Mainnet Beta (v0.34.x), issued tokens still cannot be revoked.

Provider credentials

Choose a service from the RPC provider directory and follow that provider's authentication instructions. Credentials for a managed endpoint come from its operator, not this documentation portal. Do not assume that one provider's credential format or permissions apply to another provider.

For a light node connecting to an authenticated consensus gRPC endpoint, see consensus endpoint authentication.

Transaction signing

A transaction signer is separate from an endpoint credential. The Go and Rust quickstarts explain signer setup and funding. A valid endpoint credential does not fund the signer's account.

If a request fails, check the target host, network, and required permission with the provider. Use the developer portal to find the relevant API contract and testnet guide.