Getting started
Authentication
Every request is authenticated with a workspace API key, sent as a bearer token.
Sending your key
Put the key in the Authorization header of every request.
Requests without a valid key return 401 Unauthorized. That includes keys that have been revoked or have expired.
Key types
| Prefix | Environment | Use for |
|---|---|---|
neno_api_live_ |
Live | Production traffic |
neno_api_test_ |
Sandbox | Development, CI and demos |
Workspaces
A key belongs to exactly one workspace, and every request made with it is limited to that workspace. The X-Workspace-Id header isn’t accepted here. If you manage several workspaces, create a key in each one and pick the key per request.
Storing keys
Treat keys like passwords. Keep them on your server in a secrets manager or environment variable, and never ship them in browser or mobile code. If a key is exposed, revoke it in the dashboard and create a new one.