--- title: "API authentication" description: "How to authenticate Noxtica server API requests: credential formats, key prefixes, scopes and which scope each operation requires." canonical_url: "https://noxtica.com/docs/api/authentication/" markdown_url: "https://noxtica.com/docs/api/authentication/index.md" last_updated: 2026-10-27 published: 2026-10-27 section: "server-apis" section_title: "Server APIs" openapi_release: "v0.4.0" openapi_spec_version: "0.4.0" site: "Noxtica" language: "en" source: markdown --- # API authentication Server API requests carry a credential in the `Authorization` header. Keep the credential on your server, load it from a secret store or an environment variable, and never put it in client-side code, a URL or a log line. ```http Authorization: Bearer YOUR_API_KEY ``` ## Keys and base URLs Create and manage server API keys in the Backoffice under Integrations & API. The secret is shown once when a key is created or rotated, so store it immediately. Send each request to the base URL of the API you call: | Environment | Base URL | Key prefix | APIs | | --- | --- | --- | --- | | Production | `https://collect.noxtica.com` | `sk_prod_` | [Identity verification API](https://noxtica.com/docs/api/reference/kyc/), [Risk scoring and agent trust API](https://noxtica.com/docs/api/reference/score/), [Protected actions API](https://noxtica.com/docs/api/reference/protected-actions/), [Device intelligence API](https://noxtica.com/docs/api/reference/device/), [Mobile and device identity API](https://noxtica.com/docs/api/reference/mobile/), [Telemetry ingestion API](https://noxtica.com/docs/api/reference/ingest/), [Observability query API](https://noxtica.com/docs/api/reference/observability/), [Health and public key endpoints](https://noxtica.com/docs/api/reference/status/) | | Production ingest host | `https://ingest.noxtica.com` | | [Telemetry ingestion API](https://noxtica.com/docs/api/reference/ingest/), [Observability query API](https://noxtica.com/docs/api/reference/observability/) | | Production | `https://backoffice.noxtica.com` | | [MCP server](https://noxtica.com/docs/api/reference/mcp/) | | Production (not yet deployed) | `https://pulse.noxtica.com` | | [Pulse tenant API](https://noxtica.com/docs/api/reference/pulse/) | ## Credentials ### ApiKeyAuth Format: `Authorization: Bearer sk_`. Server-to-server tenant API key. Header: `Authorization: Bearer sk_...`. Scopes are self-mintable per tenant; the scope required by each operation is listed in that operation's `security` block. Recognized KYC/KYB/KYM scopes: `write:identity` (verify, batch, reverify, evidence, sessions, erasure and activate — all share this one scope, there is no separate `read:identity`), `write:kym` (KYM transactions). Used by: [Identity verification API](https://noxtica.com/docs/api/reference/kyc/), [Risk scoring and agent trust API](https://noxtica.com/docs/api/reference/score/), [Protected actions API](https://noxtica.com/docs/api/reference/protected-actions/), [Device intelligence API](https://noxtica.com/docs/api/reference/device/), [Mobile and device identity API](https://noxtica.com/docs/api/reference/mobile/), [Observability query API](https://noxtica.com/docs/api/reference/observability/). ### SessionTokenAuth Format: `Authorization: Bearer kycs..`. Opaque hosted-session bearer token, minted once by the matching `POST .../sessions` S2S call and never re-issued. The tenant id rides inside the token itself. Additionally origin-enforced against the tenant's `ALLOWED_ORIGINS` allowlist — a missing or disallowed `Origin` header refuses with `403 origin_not_allowed` even given a valid token. Used by: [Identity verification API](https://noxtica.com/docs/api/reference/kyc/). ### ApmIngestKeyAuth Format: `Authorization: Bearer sk_apm_`. Dedicated ingestion key (`sk_apm_...`, matching `^sk_apm_[A-Za-z0-9_-]{24,256}$`), created per project and environment under Integrations & API → Ingestion API keys. It carries an allowlist of signals chosen at creation and is the ONLY credential the ingestion operations accept: a server API key (`sk_...`), however broad its scopes, is rejected there, and an `sk_apm_` key is rejected on every other route. Used by: [Telemetry ingestion API](https://noxtica.com/docs/api/reference/ingest/). ### CodingAgentKeyAuth Format: `Authorization: Bearer cak_`. Coding-agent read key (`Authorization: Bearer cak_...`, matching `^cak_[A-Za-z0-9_-]{24,256}$`), created under Integrations & API → Coding agent keys with a chosen set of scopes. It is accepted only by the coding-agent read operations, on the ingestion hosts; a server API key (`sk_...`) or an ingestion key (`sk_apm_...`) is rejected there. Used by: [Observability query API](https://noxtica.com/docs/api/reference/observability/). ### McpTokenAuth Format: `Authorization: Bearer mcp_`. MCP token (`Authorization: Bearer mcp_...`) created under Integrations & API, MCP tokens. A static opaque bearer token, not OAuth. It is accepted only by this endpoint. Used by: [MCP server](https://noxtica.com/docs/api/reference/mcp/). ### tenantKey Format: `Authorization: Bearer sk_prod_<32 hex>`. The platform's tenant API key (minted in the Backoffice; scopes `read:pulse`, `write:pulse`), for the tenant's own back-end on `/pulse/v1/tenant/*` only. Looked up through an HMAC hash; a device token or a web session is refused. Used by: [Pulse tenant API](https://noxtica.com/docs/api/reference/pulse/). ## Scopes Choose the narrowest scopes that cover what a key has to do. A key without the scope an operation requires is rejected. | Scope | Credential | Grants | Operations | | --- | --- | --- | --- | | `erase:behavioral` | `ApiKeyAuth` | | [`v1EraseBehavioralSubject`](https://noxtica.com/docs/api/reference/device/#v1EraseBehavioralSubject) | | `read:apm` | `ApiKeyAuth` | | [`v1ApmListProjects`](https://noxtica.com/docs/api/reference/observability/#v1ApmListProjects), [`v1ApmListProjectEnvironments`](https://noxtica.com/docs/api/reference/observability/#v1ApmListProjectEnvironments), [`v1ApmGetEnvironmentPolicy`](https://noxtica.com/docs/api/reference/observability/#v1ApmGetEnvironmentPolicy), [`v1ApmSearchTraces`](https://noxtica.com/docs/api/reference/observability/#v1ApmSearchTraces), [`v1ApmGetTrace`](https://noxtica.com/docs/api/reference/observability/#v1ApmGetTrace), [`v1ApmListServices`](https://noxtica.com/docs/api/reference/observability/#v1ApmListServices), and 2 more | | `read:behavioral` | `ApiKeyAuth` | | [`v1GetBehavioralSubject`](https://noxtica.com/docs/api/reference/device/#v1GetBehavioralSubject), [`v1GetBehavioralSubjectTimeline`](https://noxtica.com/docs/api/reference/device/#v1GetBehavioralSubjectTimeline) | | `read:device` | `ApiKeyAuth` | | [`getAgentPassport`](https://noxtica.com/docs/api/reference/score/#getAgentPassport), [`postAgentPassport`](https://noxtica.com/docs/api/reference/score/#postAgentPassport), [`postAgentVerify`](https://noxtica.com/docs/api/reference/score/#postAgentVerify), [`postIpReputation`](https://noxtica.com/docs/api/reference/score/#postIpReputation), [`postScore`](https://noxtica.com/docs/api/reference/score/#postScore), [`postProtectedActionsVerify`](https://noxtica.com/docs/api/reference/protected-actions/#postProtectedActionsVerify), and 8 more | | `read:events` | `ApiKeyAuth` | | [`v1ListEvents`](https://noxtica.com/docs/api/reference/device/#v1ListEvents) | | `read:export` | `ApiKeyAuth` | | [`v1ExportFingerprints`](https://noxtica.com/docs/api/reference/device/#v1ExportFingerprints), [`v1ExportEvents`](https://noxtica.com/docs/api/reference/device/#v1ExportEvents), [`v1ExportVisits`](https://noxtica.com/docs/api/reference/device/#v1ExportVisits), [`v1ExportScoredEvents`](https://noxtica.com/docs/api/reference/device/#v1ExportScoredEvents), [`v1GetEmergingThreats`](https://noxtica.com/docs/api/reference/device/#v1GetEmergingThreats), [`v1ApmGetExport`](https://noxtica.com/docs/api/reference/observability/#v1ApmGetExport), and 1 more | | `read:fingerprints` | `ApiKeyAuth` | | [`v1ListDevices`](https://noxtica.com/docs/api/reference/device/#v1ListDevices), [`v1ListAccountDevices`](https://noxtica.com/docs/api/reference/device/#v1ListAccountDevices) | | `read:privacy_request` | `ApiKeyAuth` | | [`v1ApmGetPrivacyExport`](https://noxtica.com/docs/api/reference/observability/#v1ApmGetPrivacyExport), [`v1ApmGetPrivacyErasure`](https://noxtica.com/docs/api/reference/observability/#v1ApmGetPrivacyErasure) | | `read:pulse` | `tenantKey` | Read subject status and links. | [`pulseTenantSubjectStatus`](https://noxtica.com/docs/api/reference/pulse/#pulseTenantSubjectStatus), [`pulseTenantListDecisions`](https://noxtica.com/docs/api/reference/pulse/#pulseTenantListDecisions), [`pulseTenantGetDecision`](https://noxtica.com/docs/api/reference/pulse/#pulseTenantGetDecision), [`pulseTenantGetLink`](https://noxtica.com/docs/api/reference/pulse/#pulseTenantGetLink) | | `read:reputation` | `ApiKeyAuth` | | [`v1VerifyReputation`](https://noxtica.com/docs/api/reference/score/#v1VerifyReputation) | | `read:sealed_results` | `ApiKeyAuth` | | [`v1GetSealedResultsKey`](https://noxtica.com/docs/api/reference/device/#v1GetSealedResultsKey) | | `read:visits` | `ApiKeyAuth` | | [`v1ListVisits`](https://noxtica.com/docs/api/reference/device/#v1ListVisits) | | `write:apm` | `ApiKeyAuth` | | [`v1ApmUpdateEnvironmentPolicy`](https://noxtica.com/docs/api/reference/observability/#v1ApmUpdateEnvironmentPolicy), [`v1ApmCreateExport`](https://noxtica.com/docs/api/reference/observability/#v1ApmCreateExport) | | `write:crawl_voucher` | `ApiKeyAuth` | | [`v1MintCrawlVoucher`](https://noxtica.com/docs/api/reference/score/#v1MintCrawlVoucher) | | `write:generate` | `ApiKeyAuth` | | [`v1GenerateFingerprintBatch`](https://noxtica.com/docs/api/reference/device/#v1GenerateFingerprintBatch), [`v1GenerateSingleFingerprint`](https://noxtica.com/docs/api/reference/device/#v1GenerateSingleFingerprint) | | `write:handoff` | `ApiKeyAuth` | | [`postHandoffMint`](https://noxtica.com/docs/api/reference/mobile/#postHandoffMint), [`postHandoffConsume`](https://noxtica.com/docs/api/reference/mobile/#postHandoffConsume) | | `write:identity` | `ApiKeyAuth` | | [`kycVerify`](https://noxtica.com/docs/api/reference/kyc/#kycVerify), [`kycAddressDocumentCrossMatch`](https://noxtica.com/docs/api/reference/kyc/#kycAddressDocumentCrossMatch), [`kycVerifyBatchSubmit`](https://noxtica.com/docs/api/reference/kyc/#kycVerifyBatchSubmit), [`kycVerifyBatchStatus`](https://noxtica.com/docs/api/reference/kyc/#kycVerifyBatchStatus), [`kycVerifyBatchResults`](https://noxtica.com/docs/api/reference/kyc/#kycVerifyBatchResults), [`kycVerifyBatchCancel`](https://noxtica.com/docs/api/reference/kyc/#kycVerifyBatchCancel), and 19 more | | `write:identity:trusted-subject` | `ApiKeyAuth` | | [`walletSuspend`](https://noxtica.com/docs/api/reference/mobile/#walletSuspend) | | `write:kym` | `ApiKeyAuth` | | [`kymTransactionsReport`](https://noxtica.com/docs/api/reference/kyc/#kymTransactionsReport) | | `write:labels` | `ApiKeyAuth` | | [`v1WriteLabel`](https://noxtica.com/docs/api/reference/device/#v1WriteLabel) | | `write:passkey` | `ApiKeyAuth` | | [`postPasskeyChallenge`](https://noxtica.com/docs/api/reference/mobile/#postPasskeyChallenge), [`postPasskeyRegister`](https://noxtica.com/docs/api/reference/mobile/#postPasskeyRegister), [`postPasskeyAssert`](https://noxtica.com/docs/api/reference/mobile/#postPasskeyAssert) | | `write:pulse` | `tenantKey` | Issue link codes, unlink and reverse decisions. | [`pulseTenantReverseDecision`](https://noxtica.com/docs/api/reference/pulse/#pulseTenantReverseDecision), [`pulseTenantCreateLinkCode`](https://noxtica.com/docs/api/reference/pulse/#pulseTenantCreateLinkCode), [`pulseTenantUnlink`](https://noxtica.com/docs/api/reference/pulse/#pulseTenantUnlink) | ## Failed authentication A missing, malformed or revoked credential, and a credential without the required scope, are rejected before the operation runs. See [Errors](https://noxtica.com/docs/api/errors/) for the status codes and bodies. _This page is generated from the Noxtica OpenAPI specification release `v0.4.0`: `kyc.yaml` version `1.2.0-2026-10-27` (SHA-256 `c91a695cfde0`), `mcp.yaml` version `0.1.0-2026-10-27` (SHA-256 `1a4875efa736`), `pulse.yaml` version `0.9.0-2026-10-27` (SHA-256 `95196a58bb5b`), `v1.yaml` version `1.3.0-2026-10-27` (SHA-256 `3fd15257a022`). Do not edit it by hand._