Free 30-min Web3 Consultation
Book Consultation
Smart Contract Security Audits
View Audit Services
Custom DeFi Protocol Development
Explore DeFi
Full-Stack Web3 dApp Development
View App Services
Free 30-min Web3 Consultation
Book Consultation
Smart Contract Security Audits
View Audit Services
Custom DeFi Protocol Development
Explore DeFi
Full-Stack Web3 dApp Development
View App Services
Free 30-min Web3 Consultation
Book Consultation
Smart Contract Security Audits
View Audit Services
Custom DeFi Protocol Development
Explore DeFi
Full-Stack Web3 dApp Development
View App Services
Free 30-min Web3 Consultation
Book Consultation
Smart Contract Security Audits
View Audit Services
Custom DeFi Protocol Development
Explore DeFi
Full-Stack Web3 dApp Development
View App Services
LABS
Glossary

JSON-RPC

JSON-RPC is a stateless, lightweight remote procedure call (RPC) protocol that uses JSON (JavaScript Object Notation) for data exchange, serving as the primary API for interacting with Ethereum and other blockchain nodes.
Chainscore © 2026
definition
PROTOCOL

What is JSON-RPC?

JSON-RPC is a stateless, lightweight remote procedure call (RPC) protocol that uses JSON for data serialization. It is the primary communication standard for interacting with blockchain nodes, including Ethereum, Bitcoin, and many other networks.

JSON-RPC is a protocol specification that defines how a client can request a server to execute a named procedure with specified parameters and receive a structured response. The request is a JSON object containing the jsonrpc version, a method name, params, and an id for matching the response. The server's response is also a JSON object containing a result on success or an error object on failure, along with the same id. This simple, transport-agnostic design makes it ideal for client-server communication in distributed systems like blockchains.

In the context of blockchain, JSON-RPC is the foundational layer for node communication. A client, such as a wallet, dApp frontend, or backend service, sends JSON-RPC requests to a node to query data (e.g., eth_getBalance) or submit transactions (e.g., eth_sendRawTransaction). The node, acting as the server, processes the request against its local copy of the blockchain and returns the result. This protocol enables all core interactions: reading block data, fetching transaction receipts, estimating gas, and listening for events via subscriptions. Popular client libraries like web3.js and ethers.js are essentially sophisticated JSON-RPC wrappers.

The protocol's stateless nature means each request must contain all necessary information, and the server does not retain session data between calls. While the core specification is transport-agnostic, in blockchain implementations, it is almost exclusively carried over HTTP or WebSocket. HTTP is used for simple request-response calls, while WebSocket connections are crucial for subscribing to real-time events using methods like eth_subscribe. This dual-transport support allows developers to build responsive applications that can both query historical state and react to new blocks, pending transactions, or log emissions instantly.

A critical aspect of JSON-RPC in decentralized networks is that the protocol itself does not define authentication or batch request handling, leaving these to implementations. For security, nodes often expose the RPC endpoint to localhost only or use reverse proxies with authentication for remote access. Batch requests, where multiple method calls are sent in a single HTTP request, are supported and improve efficiency. The open and simple structure of JSON-RPC has made it the universal standard for blockchain interoperability, allowing a diverse ecosystem of tools and services to communicate with any compliant node.

etymology
TECHNICAL PROTOCOL

Etymology and Origin

The name JSON-RPC is a compound term that precisely describes its core function and technical lineage.

The term JSON-RPC is a portmanteau of JSON (JavaScript Object Notation) and RPC (Remote Procedure Call), defining a stateless, lightweight protocol for client-server communication. It was created by Swedish developer Mattias Flodin in 2005 as a simpler alternative to XML-based RPC protocols like XML-RPC and SOAP. The design goal was to leverage JSON's human-readable format and native compatibility with web technologies to enable straightforward data exchange between distributed systems.

The protocol's origin is deeply rooted in the web development ecosystem of the early 2000s. As AJAX (Asynchronous JavaScript and XML) gained popularity for building dynamic web applications, developers sought a more efficient data-interchange format than XML. JSON, derived from JavaScript object literal syntax, emerged as a superior alternative due to its minimal syntax and direct parsing by JavaScript engines. JSON-RPC formalized this by specifying a simple request-response structure where a client invokes a method on a remote server by sending a JSON object containing the method name and params, with the server returning a JSON object containing a result or error.

In the blockchain context, JSON-RPC found its quintessential application as the primary interface for interacting with node software. Ethereum's adoption of a JSON-RPC API was pivotal, establishing it as the standard for wallets, dApps, and block explorers to query chain data (eth_getBalance) and submit transactions (eth_sendTransaction). This established a clear separation between the node's core functionality and the applications built on top of it, fostering a rich and interoperable developer ecosystem. The protocol's statelessness aligns perfectly with blockchain's decentralized architecture.

The evolution of JSON-RPC is marked by specification versions, with JSON-RPC 2.0 being the most widely implemented. Published in 2010, version 2.0 introduced key improvements like named parameters, batch requests, and a standardized error object. While the core protocol is transport-agnostic, it is most commonly carried over HTTP or WebSockets in blockchain implementations. Its enduring success stems from its deliberate simplicity, which reduces implementation complexity for both client and server developers compared to more verbose alternatives.

Today, JSON-RPC is synonymous with blockchain interoperability. Nearly every major blockchain node—including Bitcoin (despite its custom binary protocol, with wrappers like bitcoin-cli translating to JSON-RPC), Ethereum, Polygon, and Avalanche—exposes a JSON-RPC endpoint. This universality allows tooling like MetaMask, The Graph, and block explorers to support multiple chains with minimal adaptation. The term's etymology now evokes not just a general web protocol, but the fundamental API layer of Web3 infrastructure.

key-features
JSON-RPC

Key Features

JSON-RPC is a stateless, lightweight remote procedure call (RPC) protocol that uses JSON for data serialization. It defines the core interface for applications to interact with blockchain nodes.

01

Request-Response Model

JSON-RPC operates on a simple client-server model. A client sends a JSON-formatted request containing a method name and parameters, and the server returns a JSON-formatted response with a result or error.

  • Standard Structure: Every request includes jsonrpc, method, params, and id fields.
  • Synchronous: The response is directly tied to a specific request ID, making it predictable for developers.
02

Transport Agnostic

The JSON-RPC specification is independent of the underlying transport layer. This allows it to work over various protocols, providing flexibility for different deployment scenarios.

  • Common Transports: Most commonly implemented over HTTP/S and WebSockets.
  • WebSockets for Streaming: WebSocket connections enable subscriptions for real-time events like new blocks or pending transactions, which HTTP's request-response model cannot support natively.
03

Method-Oriented Design

Interaction with a node is performed by calling specific RPC methods. Each method corresponds to a distinct node function, such as querying data or submitting a transaction.

  • Core Methods: Standard methods include eth_getBalance, eth_sendRawTransaction, and net_version.
  • Namespace Convention: Methods are often prefixed with a namespace (e.g., eth_, net_, debug_) to categorize functionality by component.
04

Standardized Error Handling

The protocol includes a well-defined error object structure in responses, ensuring clients can programmatically understand and handle failures.

  • Error Object: Contains a numeric code, a message string, and optional data.
  • Predefined Codes: Standard error codes (e.g., -32600 for Invalid Request, -32601 for Method Not Found) allow for consistent error handling across different client implementations.
05

Batch Requests

Clients can send multiple RPC calls bundled into a single request, improving efficiency by reducing network overhead and latency.

  • Single HTTP Call: An array of request objects is sent in one payload.
  • Independent Responses: The server processes each request independently and returns an array of responses, preserving the order of the original requests.
06

Stateless & Idempotent

JSON-RPC is designed to be stateless, meaning each request contains all necessary information for the server to process it. Most core methods are also idempotent.

  • No Server Session: The server does not maintain client state between requests.
  • Safe Retries: Idempotent methods (like eth_getBlockByNumber) can be safely repeated without causing different side effects, simplifying error recovery.
how-it-works
PROTOCOL EXPLAINER

How JSON-RPC Works

A technical breakdown of the JSON-RPC protocol, the fundamental communication layer for interacting with blockchain nodes and decentralized applications.

JSON-RPC (JavaScript Object Notation Remote Procedure Call) is a stateless, lightweight remote procedure call (RPC) protocol that uses JSON for data serialization. It defines a simple set of rules for structuring requests and responses, enabling a client application to invoke functions or methods on a remote server, such as a blockchain node. The core specification is transport-agnostic, meaning it can operate over HTTP, WebSockets, or other message-passing environments, making it highly versatile for distributed systems.

A standard JSON-RPC request is a JSON object containing three key members: the jsonrpc version (e.g., "2.0"), a method string specifying the procedure to call (like eth_getBalance), and params which can be an array or object of arguments. The request may also include an id (number or string) for matching responses. A node processes this request and returns a response object, which includes the same jsonrpc and id fields, along with either a result field containing the requested data or an error field with a code and message if the call failed.

In the blockchain context, JSON-RPC is the primary interface for querying node data and submitting transactions. For example, to get the balance of an Ethereum address, a wallet would send a request with the method eth_getBalance and the address as a parameter. The node's RPC server executes the corresponding internal function and returns the balance in wei. This protocol enables all core interactions: reading block data, estimating gas, fetching transaction receipts, and broadcasting signed transactions to the network.

While simple, the protocol's design has significant implications. Its statelessness means each request must contain all necessary context, and the client is responsible for managing state like nonces. The use of JSON makes it human-readable and easy to debug with tools like curl, but it can be less efficient than binary protocols. For performance-critical or real-time applications, developers often use WebSocket connections with JSON-RPC to subscribe to events (e.g., eth_subscribe for new blocks) instead of polling via repeated HTTP requests.

Implementing JSON-RPC requires both client and server adherence to the specification. Server-side, node software (Geth, Erigon, Nethermind) exposes an RPC endpoint. Client-side, developers use libraries like web3.js or ethers.js, which provide abstractions that construct the proper JSON-RPC requests and handle the responses, simplifying application code. Error handling is crucial, as the error object in a response follows a standardized format, allowing clients to programmatically react to issues like invalid parameters (-32602), method not found (-32601), or internal node errors (-32603).

code-example
JSON-RPC IN ACTION

Code Example: A Typical Request

A practical illustration of a JSON-RPC request and its corresponding response, demonstrating the core structure and fields used to interact with a blockchain node.

A typical JSON-RPC request is a structured JSON object sent via HTTP POST to a node's endpoint. The request must include the jsonrpc field (set to "2.0"), a method string specifying the API call (e.g., "eth_getBalance"), a params array containing the arguments for the method, and a unique id for matching the request to its response. For example, a request to query an account balance would specify the account address and a block parameter, such as "latest".

The params array is where the specific data for the blockchain operation is passed. In the eth_getBalance example, the first parameter is the Ethereum address (e.g., "0x742d35Cc6634C0532925a3b844Bc9e..."), and the second is the block identifier, which can be a block number in hex or a tag like "latest", "earliest", or "pending". This structure is consistent across most JSON-RPC methods, whether querying data, sending transactions, or interacting with smart contracts.

Upon receiving a valid request, the node processes it and returns a JSON-RPC response object. A successful response will contain the same jsonrpc and id values as the request, with the result of the call in the result field. For our balance query, the result would be the account's wei balance as a hexadecimal string. If an error occurs, the response will omit the result field and instead include an error object with a code and message detailing the failure.

This request-response pattern is fundamental to all client-node communication. Developers use libraries like web3.js or ethers.js to abstract the manual construction of these JSON objects, but understanding the underlying protocol is crucial for debugging, building lightweight clients, or integrating with chains that use JSON-RPC variants. The stateless nature of each request makes the protocol simple and reliable for decentralized network access.

ecosystem-usage
JSON-RPC

Ecosystem Usage

JSON-RPC is the foundational protocol for programmatic interaction with blockchain nodes. Its ecosystem comprises the tools, libraries, and services that developers use to build decentralized applications.

BLOCKCHAIN API ARCHITECTURE

Comparison: JSON-RPC vs. Other APIs

A technical comparison of JSON-RPC with common API paradigms used in blockchain and web development.

Feature / CharacteristicJSON-RPCREST (RESTful API)GraphQL

Architectural Style

Remote Procedure Call (RPC)

Representational State Transfer

Query Language

Request Structure

Method-driven (single endpoint)

Resource-driven (multiple endpoints)

Query-driven (single endpoint)

Data Fetching

Fixed response per method

Fixed response per endpoint (often over/under-fetching)

Client-defined response shape

Primary Use Case in Web3

Direct node communication (e.g., eth_call, eth_sendTransaction)

Indexed blockchain data & analytics (e.g., block explorers)

Flexible querying of indexed data graphs

State Management

Stateless

Stateless

Stateless

Transport Protocol

Primarily HTTP(S), also WebSockets, IPC

HTTP(S)

HTTP(S)

Response Format

JSON

Typically JSON

JSON

Complexity for Simple Queries

Low (single object)

Low (single endpoint call)

Medium (requires query construction)

Complexity for Complex Queries

High (requires multiple calls/batching)

High (requires multiple calls)

Low (single, nested query)

Typical Provider

Node client (Geth, Erigon, etc.)

Indexing service (Alchemy, Infura, etc.)

Indexing service (The Graph, etc.)

security-considerations
JSON-RPC

Security Considerations

JSON-RPC is a stateless, lightweight remote procedure call protocol that is the primary interface for interacting with Ethereum and other EVM-based nodes. Its open, network-exposed nature introduces several critical security vectors that developers and node operators must manage.

01

Exposed Endpoints & Access Control

By default, JSON-RPC endpoints (e.g., http://localhost:8545) are often exposed to all network interfaces, making them accessible to anyone on the local network or the public internet if firewalls are misconfigured. Key risks include:

  • Unrestricted Public Access: Can lead to unauthorized queries, spam, or node takeover.
  • Sensitive Data Leakage: Methods like eth_accounts or debug_traceTransaction can expose private information.
  • Mitigation: Bind to 127.0.0.1 (localhost), use firewalls, and implement authentication (e.g., JWT tokens with --authrpc in Geth).
02

Unsafe RPC Methods

Certain JSON-RPC methods are inherently dangerous if exposed. The most critical is eth_sendTransaction, which requires the node to hold and manage private keys in memory. This is a severe risk for externally exposed nodes. Best practices:

  • Never expose signer methods on public-facing nodes.
  • Use external signers (e.g., Hardware Security Modules, MetaMask) and only expose eth_sendRawTransaction.
  • Disable dangerous debug and tracing namespaces (e.g., debug, txpool, admin) in production.
03

Transaction Origin & Phishing

A malicious website can connect to a user's local node (like MetaMask's provider) and submit transactions that appear legitimate. This exploits the msg.sender vs. tx.origin distinction in Solidity.

  • tx.origin Attack: A contract that uses tx.origin for authorization can be tricked by a malicious intermediary contract.
  • Mitigation: Smart contracts should use msg.sender for authentication. Wallets should clearly display transaction details and request user confirmation for all RPC-initiated actions.
04

State Manipulation & Front-Running

JSON-RPC calls like eth_call (for simulating transactions) and eth_estimateGas rely on the current state of the node. An attacker can manipulate a node's view of the state to cause faulty simulations.

  • Sandwich Attacks: By controlling mempool data via txpool methods, attackers can front-run transactions.
  • Time-of-Check Time-of-Use (TOCTOU): The state can change between a simulation (eth_call) and the actual transaction submission (eth_sendRawTransaction).
  • Mitigation: Use nodes from multiple, reputable providers and be aware of simulation limitations.
05

Resource Exhaustion (DoS) Attacks

JSON-RPC endpoints are vulnerable to Denial-of-Service attacks that consume node resources.

  • Expensive Queries: Methods like eth_getLogs with a large block range or complex debug_traceTransaction calls can consume excessive CPU and memory.
  • Mempool Spam: Flooding the node with low-fee transactions via eth_sendRawTransaction.
  • Mitigation: Implement rate limiting, set sane default query limits, and use monitoring to alert on abnormal load. Public providers often strictly limit these methods.
06

Transport Security (HTTP vs. WS vs. IPC)

The transport layer for JSON-RPC (HTTP, WebSockets, IPC) has distinct security implications.

  • HTTP: Prone to eavesdropping if not using HTTPS (TLS). Always use https:// for any remote connection.
  • WebSockets (WS/WSS): Similar to HTTP; use WSS (WebSockets Secure) to encrypt the persistent connection.
  • Inter-Process Communication (IPC): The most secure for local communication, as it uses file system sockets, not the network. It is the recommended method for local dapp/node interaction.
evolution
PROTOCOL HISTORY

Evolution: From JSON-RPC to JSON-RPC 2.0

A technical overview of the key differences and improvements introduced in the second version of the JSON Remote Procedure Call protocol, which underpins most blockchain node communication.

JSON-RPC 2.0 is a stateless, lightweight remote procedure call (RPC) protocol that refines and standardizes its predecessor, using JSON (RFC 4627) for data interchange. The primary goal of the 2.0 specification was to address ambiguities and limitations in the original, informal JSON-RPC protocol, establishing a more robust, well-defined standard. Key mandates include a required jsonrpc: "2.0" member in every request and response, a strict specification for error handling with predefined codes, and support for batch requests. This formalization made it the de facto standard for APIs in decentralized systems, particularly for communicating with blockchain nodes like Ethereum clients.

The protocol's architecture is built around a simple request-response model. A client sends a request object containing the jsonrpc version, a method name to invoke on the server, optional parameters (either by-position or by-name), and a unique id for correlating the response. The server then returns a response object containing the same id, the result of a successful execution, or an error object if the call failed. This model's statelessness means each request must contain all necessary information, making it ideal for HTTP transport and aligning perfectly with the query-based nature of blockchain node interactions, such as calling eth_getBalance or eth_sendRawTransaction.

Several critical enhancements in JSON-RPC 2.0 directly benefit blockchain development. Error handling was vastly improved with a standardized error object featuring numeric codes (e.g., -32601 for Method Not Found, -32602 for Invalid Params) and descriptive messages, allowing clients to programmatically handle failures. Batch requests enable sending multiple RPC calls in a single HTTP request, which is optimized for efficiency when fetching unrelated data from a node. Furthermore, the specification clearly differentiates between notifications (requests with a null id that expect no response) and standard calls, providing more flexibility in designing event-driven or subscription-like patterns, even before native subscriptions were common.

JSON-RPC

Common Misconceptions

JSON-RPC is a fundamental protocol for blockchain interaction, but its simplicity often leads to misunderstandings about its capabilities, security, and role in the stack.

No, JSON-RPC is a stateless, lightweight remote procedure call (RPC) protocol, while a node is the software that implements the blockchain's consensus rules and maintains a copy of the ledger. The node exposes a JSON-RPC interface, typically over HTTP or WebSocket, allowing external applications to query data (e.g., eth_getBalance) or submit transactions (e.g., eth_sendTransaction). You can interact with the same node using different interfaces, and the JSON-RPC layer itself holds no blockchain data.

Key Distinction:

  • Node: The server (e.g., Geth, Erigon) that validates and stores the chain.
  • JSON-RPC: The communication protocol and API specification the node provides.
JSON-RPC

Frequently Asked Questions (FAQ)

Common technical questions about JSON-RPC, the fundamental protocol for interacting with blockchain nodes.

JSON-RPC is a stateless, lightweight remote procedure call (RPC) protocol encoded in JSON that defines the standard for client applications to request data and submit transactions to a blockchain node. It works by sending a structured JSON object containing a method name (e.g., eth_getBalance), params, and an id for request/response matching to a node's HTTP, WebSocket, or IPC endpoint. The node executes the specified method and returns a corresponding JSON object with a result or error field. This protocol is the backbone of interactions between wallets like MetaMask and blockchain networks like Ethereum, enabling actions from querying balances to deploying smart contracts.

ENQUIRY

Get In Touch
today.

Our experts will offer a free quote and a 30min call to discuss your project.

NDA Protected
24h Response
Directly to Engineering Team
10+
Protocols Shipped
$20M+
TVL Overall
NDA Protected Directly to Engineering Team
JSON-RPC: Definition & Use in Blockchain Nodes | ChainScore Glossary