Gateway Access Controls

Pinata’s Dedicated Gateways make it possible to fetch and serve IPFS content quickly and reliably, however there can be security risks in exposing your gateway to the world. That’s why Pinata has created Gateway Access Controls. These controls will allow you to further limit your gateway, making sure only your platform is using it. This is accomplished with Access Tokens, IP Address Restrictions, and Host Origin Restrictions.

To start, make sure you have a Dedicated Gateway and then visit the Access Controls page .

By default, Dedicated Gateways are restricted with the lowest level restriction possible. They will only serve content that is pinned to your account. This restriction is helpful for creators and for those just getting started. But if you want to restrict access further, or if you want to access IPFS content from the wider network that may not be pinned to your account, you’ll need to add security restrictions.

​

Access Tokens

Adding an access token restriction means that content served through your gateway will only be served successfully if the access token is present with the request. Importantly, content pinned to your account won’t be accessible through your gateway if you’ve implemented an access token restriction and fail to include that token in content requests.

To create an access token, click on the button that says “Request Key.”

When you create an access token you will have the ability to preview the token by clicking the “eye” icon, or copy the token to your clipboard with the “copy” icon. At any point, you can delete an access token by clicking the “trash” icon.

Once you have the token, there are two ways you can use it in the gateway request.

​

Query Parameter

To use the query parameter method, simply add this to the end of a gateway request url:

?pinataGatewayToken=PASTE_IN_ACCESS_TOKEN

​

Header

Another way to use the access token is in the request header. The Key Value would look like this:

Please keep in mind that using the access token in the request header may not work in a client side application, so consider using IP Address restriction instead for those use cases.

​

IP Address

You can also restrict your gateway by IP Address. You can add up to 100 different IP addresses (individually). When you add this restriction, only content requested from an IP address that you’ve added will be served through your gateway.

To start, click “Set IP Address” on the right side of the menu.

You will get window asking for a valid IP Address which will allow any requests being made from the IP Address to go through!

​

Host Origin

With the Host Origin restriction, you can make sure your gateway can only be used on a specific domain (for example, ‘app.pinata.cloud’). To get started, click on “Add Host Origin.”

After that, you can add the domain you would like your gateway to be used from!

Keep in mind, if you are rendering content on the client side using Host Origins, you will need to include a crossorigin tag in your img, video, audio, link, or script elements. Here is an example with an img element in React:

<img
  src="https://pinata-media.mypinata.cloud/ipfs/CID"
  crossorigin="anonymous"
  alt="pinnie"
/>

For more info on crossorigin please read this article here!

​

Multiple Restrictions

You can add multiple Access Controls, and they will perform as an “OR” operator. This means that if you have Host Origins and Access Token set, you can use either one for content to go through.