Helius docs: pages changed or added since May

helius-laserstream = "0.2"

Line 111 says to use 0.6.3 or later, because older releases mishandle transaction v1. Cargo's "0.2" resolves to versions >=0.2.0, <0.3.0, so it can never reach 0.6.3.

Change it to "0.6" (at least 0.6.3), or use cargo add. Pin the Go snippet at line 171 the same way.

if (this.isReconnecting) return; … this.isReconnecting = true; … setTimeout(() => { this.connect(); }, jitteredDelay);

scheduleReconnect() sets the flag and then calls connect(), which returns at once because the flag is set. The flag is only cleared in onopen, which is never reached. After the first disconnect the client stays dead and its subscriptions are lost.

Clear the flag just before calling connect() in the timer, or remove the guard from connect().

lamports: 1 * LAMPORTS_PER_SOL, / amount: lamports(1_000_000_000n), // 1 SOL

The diff shows the amount was changed from 0.001 SOL. A developer who runs the "simple transfer" sample on mainnet with a real key moves 1 SOL, and the transfer cannot be undone.

Restore 0.001 SOL in both tabs.

Tab "Frontend/Browser Applications": https://sender.helius-rpc.com/fast?api-key=YOUR_API_KEY

Anyone visiting the site can read the key and spend the project's credits and quota. agents/skills/phantom.md:42 says "Never expose Helius API keys in client code".

Recommend a server-side relay or a restricted, separate browser key, and align the Phantom page.

const event = req.body; / if (event.type === 'NFT_SALE') {

Webhooks deliver an array, as data-streaming/quickstart.md:166 shows. event.type is always undefined, so no sale is ever processed.

Iterate over req.body.

const ws = new WebSocket(URL); (handlers registered: open, message and close only)

With ws, an error event with no listener is thrown. DNS failures, refused connections and 401/429 handshake rejections kill the process before the backoff runs.

Add an error handler and let close own the retry.

const requestId = Date.now();

Back-to-back subscribe() calls (lines 410 and 497) in the same millisecond overwrite each other in the map. Subscriptions are silently dropped, including on resubscribe.

Use an incrementing counter.

if (status && (status.confirmationStatus === 'confirmed' || status.confirmationStatus === 'finalized')) {

status.err is never checked, so a transaction that landed but failed is treated as success.

Check status.err first.

* **Keyless**: 1 request per second per egress IP, per region. ... Rejected 429 requests count toward the limit

The previous docs said standard users need no key and get 50 TPS. The new limit has no announcement, cut-over date or migration path. Keyless samples are still published (for example the cURL samples on the sender-max and sender-swqos-only pages), faqs/sender.md:18 still says "standard limit is 50 TPS", and api-reference/sender/llms.txt:70 says "Default 50 TPS". Existing keyless integrations will be throttled without warning.

Publish a dated change notice and a migration path. Update every keyless sample and every "50 TPS default" statement.

tokenProgram: TOKEN_PROGRAM_ADDRESS,

Line 365 says DepositAsset.spl covers "SPL and Token 2022 assets". With a Token-2022 mint, this sample builds the interface and the deposit against the wrong program, so the transaction fails.

Read the mint account's owner and require it to be either the classic token program or Token-2022. Pass that program ID in both places, and add a Token-2022 variant.

const signature = await signMessage("Sign in to Acme");

A signature over a fixed string can be replayed. Readers copy this as their login proof.

Show a challenge flow: the server issues a nonce with a domain and an expiry, the wallet signs it, and the server verifies the signature and consumes the nonce.

const signature = await signAndSendTransaction(serialized);

Wrap the call in try/catch to handle a cancelled prompt. Confirm with getSignatureStatuses before treating the action as done.

The staked endpoint (staked.helius-rpc.com) is deprecated. ... * **Higher landing rates**: Guaranteed access to staked connections

Give a sunset date, or state that there is none, and present the benefits as legacy behaviour.

Enhanced Transactions keeps working while you migrate — there is no forced cutoff.

The llms-full FAQ says the API "will be deprecated", and other pages call it maintenance mode. Readers cannot plan a migration from that.

Publish one message: the current phase, the minimum support window and the target date.

-| mintCompressedNft | Use Metaplex Bubblegum SDK directly | Helius mint API is deprecated |

Both pages now only redirect, and nothing tells existing callers what to use instead.

Keep a short "removed — use X" notice for at least one release.

<Card title="Enhanced Transactions" ... Retrieve pre-parsed transaction data in human-readable format.

Mark it as legacy and link to Parsed Events and the migration guide.

if (lastSlotSeen !== null && slot > lastSlotSeen) {

This condition is also true in normal operation. On a quiet filter, the idle case the guide covers, no notification may arrive after reconnect, so the missed window is never backfilled.

On open after a reconnect, read the current slot and backfill explicitly from lastSlotSeen to that slot.

function startPing(ws: WebSocket): void { / setInterval(() => {

Each reconnect adds another 30 s interval that keeps old sockets alive. Timers pile up for as long as the process runs.

Keep the interval ID, clear it in the close handler, and start only one timer per connection.

if (manager) manager.disconnect();

WebSocketManager (lines 306-377) defines no disconnect(). Unmount throws, and every mount leaks a metered connection. The "production-ready" class also leaves reconnection as a comment (line 345).

Add disconnect() that sets a closing flag and calls ws.close(), and implement the reconnect.

while (true) {

A key that is exhausted or blocked keeps hammering the API forever. billing/rate-limits.md prescribes at most 5 attempts with delays up to 30 s.

Limit the number of attempts, honour Retry-After, and rethrow after the last attempt.

filters.forEach((filter, i) => { / ws.send(JSON.stringify({

Pace the resubscriptions and check each response for rate-limit errors.

setInterval(() => {

Store the interval ID and clear it on shutdown.

setInterval(() => ws.ping(), 30_000);

Add a close handler that clears the interval and then reconnects or exits.

let lastProcessedSlot = Number(process.env.LAST_PROCESSED_SLOT ?? 0);

The slot is written to one place and read from another. After a restart the value is stale, and a missing value is silently turned into a 48-hour replay.

Read and write the resume slot through the same store.

if (!item) { await new Promise(r => setTimeout(r, 1)); continue; }

Have the producer signal when an item arrives instead of polling.

setLive((prev) => [JSON.parse(e.data), ...prev].slice(0, 10));

On a live event and on stream reconnect, refetch the balances and history, with a debounce.

Serialized as a string to avoid floating-point precision loss. ... amount = parseInt(amountRaw) / 10**decimals

parseInt brings back the precision loss that the string format exists to avoid. Raw amounts above 2^53 are silently rounded. wallet-api/balance-at.md already advises BigInt.

Use BigInt(amountRaw) and decimal-string formatting.

Minimum 0.0002 SOL (Dual mode) or 0.000005 SOL (SWQOS-only).

The current Sender pages set a 0.001 SOL minimum for Sender Max, and a smaller tip misses the priority buffer. Line 69 still mentions "Dual".

Update the figure and the mode name.

const preAmount = preBalance ? parseInt(preBalance.uiTokenAmount.amount) : 0;

Use BigInt arithmetic (also at lines 734-735).

gt: / type: number

Accept string-encoded raw amounts so values above 2^53 work in both directions.

derive it as Math.round(balance * 10 ** decimals).

Expose a raw string field, or state that the derived value is approximate.

Wrap it in Number(...) before doing arithmetic.

Accumulate with BigInt and convert only for display.

const maxReplaySlot = currentSlot - 691_200;

Treat the window as a time value set by the server, or derive the earliest slot from the server's response.

const load = async () => {

Ignore clicks while a load is in flight, or disable the button.

npx helius-cli signup --json

agents/cli.md says signup now needs --email, --first-name and --last-name, and by default it returns a payment link. The key only comes from --resume or --pay. An autonomous agent following this file gets no key.

Show the three-step flow from _docs_AGENTS.md.

helius signup --email you@example.com --first-name Jane --last-name Doe --json, followed by "apiKey": "your-api-key-here"

State that the apiKey payload comes only from --resume or --pay.

/plugin marketplace add helius-labs/core-ai && /plugin install helius@helius-labs

agents/claude-code-plugin.md:40 says to run the two commands separately and that pasting both at once fails.

Show two separate commands.

Auth: every surface requires an api-key query parameter

The same file lists plain-HTTP regional Sender hosts (line 30) and an x-token header for LaserStream (line 36). An agent following this line will attach the key to unencrypted URLs.

Describe authentication per surface, never put the key on http:// URLs, and prefer the header where it is supported.

- 24-hour historical replay (216,000 slots) / Choose your plan (Devnet: Developer/Business, Mainnet: Professional)

The source pages say about 48 h (about 691,200 slots), and that Business also gets mainnet. Line 53 of the same file lists Business with mainnet.

Regenerate the file from the current pages.

| Historical replay | No | No | 24 hours |

Change the replay window to 48 hours, and link /docs/preprocessed-transactions/overview.

- 24-hour historical replay

Change it to 48-hour, matching dedicated-nodes/getting-started.md:82.

heliusTransaction (parsing, history, priority fees)

agents/mcp/tools.md:112 lists getPriorityFeeEstimate under heliusChain, so agents will call the wrong tool.

Update the summary.

import Helius from 'helius-sdk'; / const helius = new Helius('YOUR_API_KEY');

The current TypeScript SDK pages document createHelius({ apiKey }) with methods directly on the client. The current Rust page requires Helius::new(key, Cluster)?.

Regenerate the snippets against the current SDKs.

// Build transaction with tip and priority fee, then send via Sender / const signature = await helius.rpc.sendTransaction(serializedTransaction, {

The tip is paid but Sender routing is not used.

Use the SDK's Sender method (sendTransactionWithSender).

| **Enhanced WebSockets** | No | Yes | Yes | Yes | vs | WebSocket Types | Standard | Standard | Standard + Enhanced |

Developer-plan access to Enhanced WebSockets and LaserStream mainnet differs within the file. Line 91 keeps a "Developer+ only" restriction on getTransactionsForAddress that the prose pages dropped.

Reconcile the file with the plans, credits and rate-limit pages.

batches of up to 100 full transactions or 1,000 signatures.

rpc/gettransactionsforaddress.md:15 says up to 1,000 full transactions per call.

Correct the figure, and re-check the other figures in the bundle against their source pages.

the mental model (embedded, non-custodial, social/passkey login) is the same.

waas/configuration.md:56-63 lists Google, Apple, Discord and X as "Coming soon". Apps that rely on social login cannot migrate their users yet.

State the gap in the guide and in its mapping table.

The autonomous helius signup --json flow requires a 1 USDC payment ... plus ~0.001 SOL

Say that this applies only to --pay.

[/docs/rpc/overview](https://www.helius.dev/docs/rpc/overview)

Link the current RPC and ZK Compression pages.

9 routed tools plus expandResult vs 10 routed tools

Use one wording everywhere.

### The wrong sign-in methods appear (e.g. Google shows, external wallet is missing)

Use a sign-in method that exists today as the example.

Once users are on their Helius wallets, remove the Privy SDK.

Make removal a main step. Then verify in a browser network log that no requests go to Privy hosts, and list the leftovers to clean up (env vars, CSP entries, lockfile).

curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | bash

Pin to a tag or commit and publish a checksum.

http://slc-sender.helius-rpc.com/fast?api-key=YOUR_API_KEY / fetch(${SENDER}/fast?api-key=${HELIUS_API_KEY}, {

The key travels unencrypted in the query string and can be sniffed or logged on the network path.

Offer HTTPS regional endpoints or header authentication, and warn against sending keys over http://.

await fetch('http://ewr-sender.helius-rpc.com/fast', {

Add the key on the server side and note the rate-limit dependency. Fix the same URL in jupiter-swap-api-via-sender.md:79.

const tx = VersionedTransaction.deserialize(buf.subarray(18));

preconf-subscribe.md:269-272 says older VersionedTransaction.deserialize handles only legacy and v0. The first v1 frame throws in the message handler and kills the trading process.

Use a decoder that supports v1, wrap decode and handler in try/catch, and fix the "bincode" wording.

const tx = VersionedTransaction.deserialize(item.txBytes);

Same as finding 53, and catch errors per item inside the while (true) loop.

(So11111111111111111111111111111111111111111 for native SOL) vs (So11111111111111111111111111111111111111112 for

Code that compares mint with the documented constant misses SOL if it followed the wrong page. wallet-api/balances.md:195/202 shows both values in one response.

State which value the API returns, and update every page to it.

| GET /v1/wallet/{wallet}/identity | 403 — paid plans only |

billing/plans.md:148 lists the Wallet API as included on Free, and billing/rate-limits.md:257 gives Free a limit that covers these endpoints.

Reconcile the pages and mark the exception in the plans table.

* NEXT_PUBLIC_HELIUS_API_KEY is set and valid.

The recommended setup in waas/quickstart.md:27-57 keeps the key on the server. This check pushes users to ship the key in the browser bundle.

Make the check depend on the setup mode.

Replace PrivyProvider with HeliusWalletProvider and pass your Helius API key

Follow the quickstart: leave the key out of the provider and use the server route handler.

const ws = new WebSocket(wss://mainnet.helius-rpc.com/?api-key=${process.env.HELIUS_API_KEY}); — only open and message handlers are registered

In the ws library, an error event with no listener is thrown as an exception. A failed upstream connection, or closing the socket while it is still connecting, takes down the Next.js process. When the upstream closes, the feed dies silently. The route has no authentication or limits, so any caller can open metered upstream sockets.

Add error and close handlers that close the stream once. Validate address, and add per-IP limits.

solana config set --url https://devnet.helius-rpc.com/?api-key=YOUR_API_KEY

zsh, the default macOS shell, treats the unquoted ? as a glob and stops with "no matches found".

Quote the URL.

| transferSol | Send SOL to another wallet (supports sendMax to drain full balance) |

The MCP and plugin pages also describe autopay from a local keypair that is stored unencrypted. A search of agents/ for approval, confirmation and spending limits found such guidance only on the OKX page.

Require explicit human approval for transfers and autopay. Advise keeping only a minimal balance in that keypair and restricting the keypair file's permissions.

const / RAYDIUM_LAUNCHPAD_PROG / = ' (a string literal broken across lines)

The script does not parse. The post also uses atlas-* hosts and says Enhanced WebSockets need a Business plan (line 134), while current pages say Developer.

Fix the literal and the hosts, or mark the post as historical.

lastProcessedSlot = maxReplaySlot;

The window keeps moving between computing the slot and subscribing. Line 136 says an out-of-window slot is rejected.

Add a safety margin, or retry with a newer slot when the request is rejected.

lastProcessedSlot = Number(data.transaction.slot);

Resuming with fromSlot set to this value replays transactions that were already handled, and the sample does not deduplicate.

Deduplicate by signature, or advance the watermark only when the slot is complete.

LaserStream gRPC Devnet is available on all plans. vs Devnet is available on Developer and above.

Choose one policy and apply it on every page.

-H "Authorization: Bearer YOUR_API_KEY" / "transactionTypes": ["Any"],

The webhook reference authenticates with ?api-key=. "Bearer" appears there only as the user's own authHeader value. Any matches no documented type (a search of webhooks/ found none).

Use ?api-key= and a documented type, or leave transactionTypes empty to match all types.

app.post("/webhook", (req, res) => { / req.body.forEach((event) => {

Anyone who knows the URL can post forged events. authHeader is listed only as an undescribed field on the create and update reference pages.

Document authHeader, check it in constant time, and reject mismatches with 401.

End of pagination is only indicated when **no accounts are returned**. ... always continue pagination until paginationKey is null.

State one rule (presumably that paginationKey is null).

'​​TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA', (two U+200B characters before the ID)

The pasted value is not a valid public key, so the filter errors or matches nothing.

Remove the characters.

accountsInclude: [

Every other sample uses accountInclude, and an unknown field means the program filter is not applied.

Rename the field to accountInclude.

<Card title="24-Hour Historical Replay" / ✅ 24h

Use 48 h everywhere.

If you see nothing at all for over a minute ... assume the connection is dead and reconnect

A half-open socket never fires close, so the at-most-once stream stalls silently.

Track the time of the last activity, and terminate the socket when it is stale.

Protocol-level WebSocket pings that client libraries send automatically do **not** reset the idle timer.

Samples on other pages use ws.ping() as their only keepalive, for example trade-on-preconfirmations.md:63 and data-streaming/quickstart.md:130. If this page is right, those samples are disconnected after 10 quiet minutes.

State per endpoint what resets the idle timer, and use that in every sample.

this.subscriptions.set(id, { method, params, callback });

The class has no onmessage handler, so callbacks never fire. The migration example (line 751) calls an unsubscribe() that does not exist.

Add message routing and unsubscribe(), as in the quickstart manager.

if (retryCount >= MAX_RETRIES) { … return;

Cap the delay and keep retrying, or exit so a supervisor restarts the process.

const { priorityFeeEstimate } = await response.json().result;

This throws a TypeError every time it runs.

Write const { result } = await response.json();.

limit: 1000, / changedSinceSlot: lastProcessedSlot

Loop on paginationKey, and advance the watermark to a slot captured before the first request.

const baseline = await helius.getProgramAccountsV2([programId, { limit: 10_000 }]);

Read the slot first, page through the whole baseline, then use the earlier slot as the watermark.

let promise: Promise<number> = new Promise(async (resolve, reject) => {

A 429 or error response throws inside the executor. reject is never called and Promise.all hangs.

Use plain async functions and check the responses.

console.log('Successful transactions in January:', data.result.data); / .flatMap(r => r.result.data)

Busy addresses are silently truncated at 1,000 results, and an error response makes the flatMap throw.

Loop on paginationToken and check r.error.

setInterval(() => ws.ping(), 30_000); // keep the connection alive

The text says the ping tells a quiet stream from a dead one, but nothing checks for a pong.

Track the time of the last pong, and terminate the socket when it is stale.

keep the connection alive on a quiet filter, and reconnect automatically on close.

The code has no keepalive and no slot-gap backfill, and it retries forever on auth errors. Delivery is at-most-once, so tokens deployed during a gap are lost.

Add a backfill, bounded backoff and a stop on auth errors, or change the claim.

if (result.parserStatus !== "OK") continue;

Collect and report failed signatures, and retry or fetch them.

const res = await request();

Catch thrown errors and apply the same backoff.

const token = balances.find(t => t.mint === tokenMint);

Pages hold at most 100 tokens sorted by value, so low-value tokens are reported as "not found".

Page through the results until the token is found.

let response: Result<Vec<EnhancedTransaction>, HeliusError> = helius.parse_transactions(request).await;

helius::error::Result (imported at line 44) takes one type parameter, and HeliusError is never imported.

Write let response = helius.parse_transactions(request).await;.

-<ParamField body="usage" type="object"> … +<ParamField body="credits" type="object">

Clients that read usage.rpc, usage.stream or usage.websocket now get undefined values, with no deprecation note.

Keep usage as a deprecated alias for a stated period, and publish a mapping from old keys to new keys.