Authentication

Every Nora /v2/* request authenticates with a single header:

X-API-Key: sk_test_...

There are no bearer tokens, no OAuth, no cookie flow for the public API. The key is the only credential.

What a key binds to

Each key is scoped to one Organization × Instance pair. The key itself encodes which org and which environment (sandbox / production) the call applies to — you never send X-Organization-ID or similar headers.

A sandbox key cannot call production and vice versa — you'll get a 403 (API key targets sandbox but this runtime serves production).

IP allowlist and expiry

Every key carries an IP allowlist. Add your servers' egress IPs or CIDR ranges when you create the key, and again when your infrastructure moves. See Core concepts → Authentication for the exact fail-closed 403 behavior.

Every key has a mandatory expiry date; the dashboard caps how far out it can be and shows the date on the key list. An expired key answers 401. Create the replacement before that date, deploy it, then revoke the old one — see Rotation below.

Creating a key

Create, list, and revoke keys via the dashboard at Settings → API Keys. See Dashboard → API keys for the UI walkthrough.

Rotation

There is no in-place rotate. Rotation is:

1. Create a new key with a descriptive name (e.g. backend-2026-04).
2. Swap the secret into your config.
3. Deploy, verify traffic flows.
4. Revoke the old key.

Revoked keys immediately return 401. Every 401 except expiry carries code: "INVALID_API_KEY"; the message tells them apart: Missing X-API-Key header, Invalid API key format, Invalid API key, API key is not active (revoked). An expired key answers code: "API_KEY_EXPIRED".

Gotchas

• Plaintext is shown once. Store it in your secret manager the moment you create the key.
• Keys are scoped. Do not try to use a sandbox key against production or vice versa — it is always a 403.

See also

• Errors — auth-related error codes
• Dashboard → API keys