Authentication

    The Nopaque API uses API keys for authentication. Each key is bound to a specific workspace and grants member-level access to all resources in that workspace.

    Creating an API Key

    1. Navigate to Workspace Settings > API Keys
    2. Click Create API Key and enter a label
    3. Copy the key immediately -- it is shown only once and cannot be retrieved later
    4. Store the key securely (e.g., CI/CD secrets, environment variable)

    Using Your API Key

    Pass your API key in the x-api-key HTTP header on every request:

    bash
    curl -H "x-api-key: nq_a1b2c3d4e5f6..." \
  https://api.nopaque.co.uk/mapping

    With the SDKs

    Pass the key when constructing the client, or set NOPAQUE_API_KEY and the SDK reads it automatically.

    python
    from nopaque import Nopaque

# Explicit
client = Nopaque(api_key="nq_...")

# Or set NOPAQUE_API_KEY in your environment, then:
client = Nopaque()

    Key Format

    Prefixnq_
    Length67 characters (nq_ + 64 hex)
    Entropy256 bits (cryptographically random)
    StorageSHA-256 hash only -- raw key never stored

    Requirements

    No key yet, and you are an agent? You do not need an account or a paid plan. Call the registerWorkspace tool on the MCP server with no credential: it creates a workspace and returns a scoped key, once. A human then verifies a mobile number with requestAnchorCode and verifyAnchorCode, which unlocks free calling capacity, and getClaimLink hands them the workspace to own and pay for.
    • Every plan, including Free, can create an API key in this web app
    • Only workspace admins and owners can create and revoke keys
    • Active key allowance per workspace, by plan:
      • Free: 1
      • Starter: 2
      • Team: 10
      • Enterprise: Unlimited
    • Rotating a key does not count against the allowance -- the superseded key is excluded from the count for the duration of the overlap window
    • Revocation takes effect immediately (zero cache TTL)

    Authentication Errors

    Invalid, revoked, or missing API keys return 401 Unauthorized with a generic message. The response does not reveal whether the key exists, is revoked, or belongs to a different workspace.

    json
    {
  "message": "Unauthorized"
}