Authentication
Authenticate API requests with a workspace-scoped API key sent as a bearer token.
Every request to the Nordvec API authenticates with an API key, sent as a
bearer token in the Authorization header.
curl https://nordvec.com/api/v1/documents/list \
-H "Authorization: Bearer $NORDVEC_API_KEY"Creating a key
Create a key from your workspace settings. The raw key is returned exactly once and is never retrievable afterwards, so copy it into your secret store straight away. Keys are scoped to the workspace that created them.
Rotating and revoking
Treat an API key like a password. If one leaks, rotate or revoke it immediately.
- Rotate replaces a key's credential in place. The previous credential keeps working until a short grace window ends, so you can roll a key out to your services without downtime.
- Revoke disables a key immediately; it can no longer authenticate.
Both actions require a signed-in session (they are not themselves API-key operations), so a leaked key cannot be used to rotate itself.
Good practice
- Store keys in a secret manager or environment variable, never in source code.
- Use a separate key per service or environment so you can revoke narrowly.
- Prefer short-lived keys for CI and scripts.