Authentication
API keys, scopes, and workspace access.
All API requests are authenticated with a bearer API key. Keys are created in the Console under Settings → API keys and are scoped to a workspace.
Authorization: Bearer nome_live_…Scopes
| Scope | Grants |
|---|---|
| env:read | Read environments, state, runs, and events. |
| env:write | Create, modify, reset, and archive environments. |
| exec | Execute operations and scenarios. |
| webhooks | Manage webhook endpoints. |
| admin | Manage keys and workspace members. |
Key hygiene
- Keys are shown once at creation. Store them in a secrets manager, not in source control.
- Rotate keys from the Console; the previous key remains valid for a configurable grace period.
- Prefer narrowly scoped keys for CI and automation.
See Security for how keys are stored and how access is audited.