Skip to main content
Settings → developers.

​
Creating a key

Generate one and copy it immediately. It authenticates as your organisation — anything the key can reach, it can change.

​
Using it

Send it raw on the Authorization header. No Bearer prefix:

​
Keeping it safe

The key can publish, delete posts and disconnect channels. Treat it as a password.Never put it in browser code — a key in a frontend bundle is public. All calls belong on your server.
Store it in an environment variable or a secret manager, never in the repository. If one leaks, revoke it here; revocation is immediate.

​
OAuth apps

Where you are building something other people connect their Nushir account to, use an OAuth app rather than sharing keys. Those tokens carry a pos_ prefix and resolve to the granting organisation.