API keys
Format, scope, storage and how keys authenticate HTTP calls and realtime connections.
An API key authenticates everything on the data plane. It looks like:
nxs_3f9a1c2b7d4e_Wc8… ← nxs_<12-hex prefix>_<secret>- A key belongs to exactly one environment. Everything it writes lands there, and everything it reads comes from there.
- Nexus stores only the prefix and a hash of the secret. The full key is shown once, when you create it — copy it then.
- Create and delete keys in the console under API keys.
Sending the key
curl https://services.inverge.net/partner/events \
-H 'x-api-key: nxs_live_xxx' \
-H 'content-type: application/json' \
-d '{"events":[{"name":"ping"}]}'Keys in client apps
A mobile or browser app has to ship its key, so treat that key as public. A key cannot sign in to the console or reach another environment, but it can call every partner endpoint of its own environment — including server-side ones such as sending a push. Two habits keep that safe:
- Give client apps and servers separate keys in the same environment. If an app key leaks, revoke it and ship a new one without touching your servers.
- Do sensitive sends (push to arbitrary users, Live Activities, voice control) from your backend, and watch Usage limits so abuse is capped.
Revoking a key in the console stops it from authenticating.
When a key is refused
| Status | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing, malformed or deleted key. |
402 | billing_suspended | The organization has unpaid invoices; the data plane is suspended until they are settled. Retrying cannot help, so the SDKs never retry it. |