Authentication
Every request carries an API key as a bearer token:
curl -sS https://nov3x.com/api/public/v1/events \
-H "Authorization: Bearer nvx_live_your_key_here"Creating a key
Go to Settings → API as a tenant admin and create a key. Give it a name you will recognise later — “Badge printer — main hall” beats “key 2”.
🔴 The key is shown once. We store only a one-way hash of it, so we cannot show it to you again and cannot recover it — not even from support. Copy it into your secret store before you close the dialog. If you lose it, create a new key and revoke the old one.
Scopes
A key carries scopes, and each endpoint requires one. Grant only what the integration needs — a badge printer does not need to read your invoices.
| Scope | Grants |
|---|---|
events.read | Read events |
registration.read | Read registrations |
invoices.read | Read invoices |
A key is its own identity. It is not acting as the person who created it, so it does not inherit their roles, and removing that person from your team does not change what the key can do.
Rotating a key
Rotation avoids downtime by running two keys briefly at once. Revoking first and creating second guarantees an outage in between.
- Rotate the key in Settings → API. This issues a new key with the same scopes and leaves the old one working.
- Deploy the new key wherever the old one is used.
- Watch Last used on the old key. Once it stops advancing, nothing is calling it any more.
- Revoke the old key.
Revoking a key
Revocation is immediate — the next request with that key gets 401. Revoke
any key you believe has leaked, and any key that has not been used in months.
Sandbox keys
Keys beginning nvx_test_ are reserved for a future sandbox and are not
available yet. Sending one today returns 401 with a message saying exactly
that, rather than a generic “invalid key” — so you can tell a
not-yet-available feature from a broken credential.