22. Overview

The JSON-RPC API server acts as the primary communication gateway for Web3 wallets, block explorers, decentralized application frontends, and node operator monitoring tools.

22.1 HTTP & WebSocket Ports

• HTTP JSON-RPC (Port 8545): Handles request-response RPC calls using standard JSON-RPC 2.0 formatting over HTTP POST.
• WebSocket RPC (Port 8546): Handles bi-directional communication and real-time pub/sub event subscriptions.

Both servers run on asynchronous event loops powered by high-performance socket libraries, capable of processing thousands of concurrent queries with sub-millisecond response times.

22.2 Loopback-Only Binding

For security reasons, the kortanad daemon binds exclusively to the local loopback address (127.0.0.1:8545 and 127.0.0.1:8546). Public RPC providers must place a hardened reverse proxy (such as Nginx, Envoy, or Cloudflare) in front of the daemon to manage SSL/TLS certificates, sanitize requests, and filter malicious payloads.

Binding exclusively to loopback prevents accidental exposure of internal RPC threads to the public internet, protecting nodes against unauthenticated remote denial-of-service attacks.

22.3 Authentication & Access Control

Sensitive administrative RPC methods—such as node shutdown, validator key reloads, and database compaction triggers—are strictly protected by authentication tokens.

Requests invoking administrative methods must include an Authorization: Bearer <SECRET_TOKEN> HTTP header matching the secure token configured in the node's local config.toml. Unauthenticated requests attempting to access protected endpoints receive an immediate HTTP 401 Unauthorized error.

22.4 Rate Limiting

The built-in RPC server enforces request size limits (maximum 5 MB per batch payload; 128 KiB per individual transaction payload) and connection rate limits to protect internal thread pools from resource exhaustion.

Edge reverse proxies deployed in front of public RPC gateways should additionally enforce IP-based rate limiting (e.g., 100 requests per minute per IP) to prevent malicious actors from degrading service availability for legitimate users.

---