On this page

API authentication

Server API requests carry a credential in the Authorization header. Keep the credential on your server, load it from a secret store or an environment variable, and never put it in client-side code, a URL or a log line.

Authorization: Bearer YOUR_API_KEY

Keys and base URLs
Credentials
Scopes
Failed authentication

How this page is organisedBar length shows each section’s share of the text. Select a section to jump to it.

ApiKeyAuth

Authorization: Bearer sk_<random>

Used by

Scopes

erase:behavioral
read:apm
read:behavioral
read:device
read:events
read:export
read:fingerprints
read:privacy_request
read:reputation
read:sealed_results
read:visits
write:apm
write:crawl_voucher
write:generate
write:handoff
write:identity
write:identity:trusted-subject
write:kym
write:labels
write:passkey

SessionTokenAuth

Authorization: Bearer kycs.<tenant>.<secret>

Used by

Identity verification API

ApmIngestKeyAuth

Authorization: Bearer sk_apm_<random>

Used by

Telemetry ingestion API

CodingAgentKeyAuth

Authorization: Bearer cak_<random>

Used by

Observability query API

McpTokenAuth

Authorization: Bearer mcp_<random>

Used by

MCP server

tenantKey

Authorization: Bearer sk_prod_<32 hex>

Used by

Pulse tenant API

Scopes

read:pulse
write:pulse

Credentials and the APIs that accept them

Keys and base URLs

Create and manage server API keys in the Backoffice under Integrations & API. The secret is shown once when a key is created or rotated, so store it immediately. Send each request to the base URL of the API you call:

Environment	Base URL	Key prefix	APIs
Production	`https://collect.noxtica.com`	`sk_prod_`	Identity verification API, Risk scoring and agent trust API, Protected actions API, Device intelligence API, Mobile and device identity API, Telemetry ingestion API, Observability query API, Health and public key endpoints
Production ingest host	`https://ingest.noxtica.com`		Telemetry ingestion API, Observability query API
Production	`https://backoffice.noxtica.com`		MCP server
Production (not yet deployed)	`https://pulse.noxtica.com`		Pulse tenant API

Credentials

ApiKeyAuth

Format: Authorization: Bearer sk_<random>.

Server-to-server tenant API key. Header: Authorization: Bearer sk_.... Scopes are self-mintable per tenant; the scope required by each operation is listed in that operation’s security block. Recognized KYC/KYB/KYM scopes: write:identity (verify, batch, reverify, evidence, sessions, erasure and activate — all share this one scope, there is no separate read:identity), write:kym (KYM transactions).

Used by: Identity verification API, Risk scoring and agent trust API, Protected actions API, Device intelligence API, Mobile and device identity API, Observability query API.

SessionTokenAuth

Format: Authorization: Bearer kycs.<tenant>.<secret>.

Opaque hosted-session bearer token, minted once by the matching POST .../sessions S2S call and never re-issued. The tenant id rides inside the token itself. Additionally origin-enforced against the tenant’s ALLOWED_ORIGINS allowlist — a missing or disallowed Origin header refuses with 403 origin_not_allowed even given a valid token.

Used by: Identity verification API.

ApmIngestKeyAuth

Format: Authorization: Bearer sk_apm_<random>.

Dedicated ingestion key (sk_apm_..., matching ^sk_apm_[A-Za-z0-9_-]{24,256}$), created per project and environment under Integrations & API → Ingestion API keys. It carries an allowlist of signals chosen at creation and is the ONLY credential the ingestion operations accept: a server API key (sk_...), however broad its scopes, is rejected there, and an sk_apm_ key is rejected on every other route.

Used by: Telemetry ingestion API.

CodingAgentKeyAuth

Format: Authorization: Bearer cak_<random>.

Coding-agent read key (Authorization: Bearer cak_..., matching ^cak_[A-Za-z0-9_-]{24,256}$), created under Integrations & API → Coding agent keys with a chosen set of scopes. It is accepted only by the coding-agent read operations, on the ingestion hosts; a server API key (sk_...) or an ingestion key (sk_apm_...) is rejected there.

Used by: Observability query API.

McpTokenAuth

Format: Authorization: Bearer mcp_<random>.

MCP token (Authorization: Bearer mcp_...) created under Integrations & API, MCP tokens. A static opaque bearer token, not OAuth. It is accepted only by this endpoint.

Used by: MCP server.

tenantKey

Format: Authorization: Bearer sk_prod_<32 hex>.

The platform’s tenant API key (minted in the Backoffice; scopes read:pulse, write:pulse), for the tenant’s own back-end on /pulse/v1/tenant/* only. Looked up through an HMAC hash; a device token or a web session is refused.

Used by: Pulse tenant API.

Scopes

Choose the narrowest scopes that cover what a key has to do. A key without the scope an operation requires is rejected.

Scope	Credential	Grants	Operations
`erase:behavioral`	`ApiKeyAuth`		`v1EraseBehavioralSubject`
`read:apm`	`ApiKeyAuth`		`v1ApmListProjects`, `v1ApmListProjectEnvironments`, `v1ApmGetEnvironmentPolicy`, `v1ApmSearchTraces`, `v1ApmGetTrace`, `v1ApmListServices`, and 2 more
`read:behavioral`	`ApiKeyAuth`		`v1GetBehavioralSubject`, `v1GetBehavioralSubjectTimeline`
`read:device`	`ApiKeyAuth`		`getAgentPassport`, `postAgentPassport`, `postAgentVerify`, `postIpReputation`, `postScore`, `postProtectedActionsVerify`, and 8 more
`read:events`	`ApiKeyAuth`		`v1ListEvents`
`read:export`	`ApiKeyAuth`		`v1ExportFingerprints`, `v1ExportEvents`, `v1ExportVisits`, `v1ExportScoredEvents`, `v1GetEmergingThreats`, `v1ApmGetExport`, and 1 more
`read:fingerprints`	`ApiKeyAuth`		`v1ListDevices`, `v1ListAccountDevices`
`read:privacy_request`	`ApiKeyAuth`		`v1ApmGetPrivacyExport`, `v1ApmGetPrivacyErasure`
`read:pulse`	`tenantKey`	Read subject status and links.	`pulseTenantSubjectStatus`, `pulseTenantListDecisions`, `pulseTenantGetDecision`, `pulseTenantGetLink`
`read:reputation`	`ApiKeyAuth`		`v1VerifyReputation`
`read:sealed_results`	`ApiKeyAuth`		`v1GetSealedResultsKey`
`read:visits`	`ApiKeyAuth`		`v1ListVisits`
`write:apm`	`ApiKeyAuth`		`v1ApmUpdateEnvironmentPolicy`, `v1ApmCreateExport`
`write:crawl_voucher`	`ApiKeyAuth`		`v1MintCrawlVoucher`
`write:generate`	`ApiKeyAuth`		`v1GenerateFingerprintBatch`, `v1GenerateSingleFingerprint`
`write:handoff`	`ApiKeyAuth`		`postHandoffMint`, `postHandoffConsume`
`write:identity`	`ApiKeyAuth`		`kycVerify`, `kycAddressDocumentCrossMatch`, `kycVerifyBatchSubmit`, `kycVerifyBatchStatus`, `kycVerifyBatchResults`, `kycVerifyBatchCancel`, and 19 more
`write:identity:trusted-subject`	`ApiKeyAuth`		`walletSuspend`
`write:kym`	`ApiKeyAuth`		`kymTransactionsReport`
`write:labels`	`ApiKeyAuth`		`v1WriteLabel`
`write:passkey`	`ApiKeyAuth`		`postPasskeyChallenge`, `postPasskeyRegister`, `postPasskeyAssert`
`write:pulse`	`tenantKey`	Issue link codes, unlink and reverse decisions.	`pulseTenantReverseDecision`, `pulseTenantCreateLinkCode`, `pulseTenantUnlink`

Failed authentication

A missing, malformed or revoked credential, and a credential without the required scope, are rejected before the operation runs. See Errors for the status codes and bodies.

This page is generated from the Noxtica OpenAPI specification release v0.4.0: kyc.yaml version 1.2.0-2026-10-27 (SHA-256 c91a695cfde0), mcp.yaml version 0.1.0-2026-10-27 (SHA-256 1a4875efa736), pulse.yaml version 0.9.0-2026-10-27 (SHA-256 95196a58bb5b), v1.yaml version 1.3.0-2026-10-27 (SHA-256 3fd15257a022). Do not edit it by hand.