Ephemeral Keys let you mint short lived, parent scoped child API keys that are safe to embed directly in client applications, including thousands of direct WebSocket connections on high throughput chains like Hyperliquid. Each key is a signed RS256 JWT with a 30 minute default TTL (60 minute max), verified offline at the edge, so there is no proxy hop and no added latency. The token references its parent by a non secret public id, never your real key, and usage rolls up to the parent. A leaked child key expires on its own within one refresh window.
Before this, embedding a key meant either exposing your long lived parent key in the client or fronting every request through a proxy, which is too slow for direct from client WebSockets. Web locked and referrer keys do not cover the WebSocket from client case. Ephemeral Keys close that gap.
What this unlocks
- Embed a key directly in browser, mobile, and WebSocket clients without shipping your parent key.
- Zero added latency: keys are verified offline at the edge against a published JWKS, with no round trip to the mint service on the hot path.
- Blast radius control: a 30 minute default TTL means a stolen child key is worthless fast, and the token carries no secret to leak.
- Consolidated usage and billing: all child key traffic rolls up to the parent key.
- Built for high fan out: designed for the Hyperliquid WebSocket case, thousands of concurrent direct clients.
- How to access it Enable Ephemeral Keys in the API key page on goldrush.dev, then mint a child key server side using your parent key. Refresh before the TTL expires.