Essentials

Authentication

Send your key in the Api-Key header on every request.

Api-Key: nd_test_4eC39HqLyjWDarjtT1zdp7dc

Keep your key on your server

A key gives access to every user and transfer in your integrator account. It belongs on your server only: never in a mobile app, a browser or a public repository. Read it from your secret store or an environment variable, and keep it out of logs.

Issuing and revoking keys

Ndeipi shows a key once, when it's issued, and stores only a hash of it. If a key leaks, ask for it to be revoked; requests with it fail at once with 401 unauthorized.

One integrator's key can never read or move another integrator's users, wallets or transfers. A request for an object that belongs to someone else returns 404 not_found, exactly as if it didn't exist.

Sandbox and production keys

Sandbox keys start nd_test_ and production keys start nd_live_. A key used against the other environment's host returns 401 key_environment_mismatch. See environments.