Authentication

Send the key in the x-api-key header:

POST /partner/flags/evaluate HTTP/1.1
Host: services.inverge.net
x-api-key: nxs_3f9a1c2b7d4e_Wc8…
content-type: application/json

{ "distinctId": "user_123", "properties": { "plan": "pro" } }

• Keys look like nxs_<12-hex prefix>_<secret> and belong to one environment.
• ?api_key= is accepted where a header cannot be set; prefer the header.
• Realtime (Socket.IO) connections pass the key in the handshake auth.key field — browsers cannot set WebSocket headers.
• CORS is open on /partner/*: browsers call it from your own front end, and the key travels in a header, never a cookie.

Create and revoke keys in the console under API keys. More in API keys.