Authentication & environments
The public API authenticates with bearer API keys. Send the key in the
Authorization header on every /v1/* request:
Authorization: Bearer nsk_live_...Environments
Section titled “Environments”Every organization has two isolated environments:
| Environment | Key prefix | Behaviour |
|-------------|-----------|-----------|
| test | nsk_test_ | Sends are recorded for visibility but never delivered and never billed. Use it in CI and development. |
| live | nsk_live_ | Real delivery, counts toward your plan’s usage. |
Data does not cross between environments — a test template is not visible to a
live key.
Key types
Section titled “Key types”- Secret keys (
nsk_test_/nsk_live_) — full server-side use. Never expose them in a browser or mobile app. - Publishable keys (
npk_test_/npk_live_) — safe for clients that only mint short-lived inbox/prefs tokens. See Embed the in-app inbox.
Scopes
Section titled “Scopes”Keys carry a coarse scope:
full_access— every endpoint.send_only— may send notifications but not read or manage configuration.
Rotating keys
Section titled “Rotating keys”Create a new key in Settings → API keys, deploy it, then revoke the old one. Revocation is immediate.