Authentication - Notvis Connect

API Keys

All API requests (except Push SDK endpoints) require authentication via an API key. You can create and manage API keys from the Notvis Connect dashboard. API keys follow the format: nc_live_XXXXXXXX...

Sending Your API Key

Include your API key in the request header using one of these methods:

curl -X POST https://api.notvis.com/v1/emails/send \
  -H "Authorization: Bearer nc_live_your_api_key" \
  -H "Content-Type: application/json"

curl -X POST https://api.notvis.com/v1/emails/send \
  -H "X-API-Key: nc_live_your_api_key" \
  -H "Content-Type: application/json"

Key Security

Never expose your API keys in client-side code, public repositories, or browser requests. Always make API calls from your backend server.

Keep keys secret — treat them like passwords
Use environment variables — never hardcode keys in source code
Rotate regularly — revoke and regenerate keys periodically
Use separate keys — create different keys for different environments (development, staging, production)

Unauthenticated Endpoints

The following endpoints do not require an API key (designed for client-side SDKs):

POST /v1/push/register — Register a push notification device
POST /v1/push/identify — Link a device to an identified user

These endpoints validate the account_id and app_id internally.