> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuvion.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Nuvion uses API keys to authenticate requests. All API calls must be made over HTTPS with a valid key.

## API keys

Nuvion authenticates requests using API keys passed as Bearer tokens in the `Authorization` header.

```bash theme={null}
Authorization: Bearer  $NUVION_API_KEY
```

API keys come in two forms:

| Environment | Base URL                 |
| ----------- | ------------------------ |
| Sandbox     | `https://api.nuvion.dev` |
| Production  | `https://api.nuvion.co`  |

No real funds move in sandbox. Always use sandbox keys during development and testing.

## Getting your API keys

API keys are environment-specific. Sandbox and production keys are managed separately.

<CardGroup cols={2}>
  <Card title="Sandbox keys" icon="flask" href="https://app.nuvion.dev/dashboard/settings">
    Create and manage sandbox keys from the Nuvion sandbox dashboard.
  </Card>

  <Card title="Production keys" icon="lock" href="https://app.nuvion.co/dashboard/settings">
    Create and manage production keys from the Nuvion production dashboard.
  </Card>
</CardGroup>

## Key scopes

API keys inherit the permissions of the user who created them. A key can only perform actions that its creator is authorized to perform within your organization.

For example:

* A key created by an admin can access all resources.
* A key created by a user with read-only access can only perform `GET` requests.

<Tip>
  Create dedicated API keys for each service or integration. This limits the blast radius if a key is compromised and makes it easier to audit which service made a given request.
</Tip>

## Making authenticated requests

Pass your API key in the `Authorization` header on every request.

<CodeGroup>
  ```bash curl theme={null}
  curl https://api.nuvion.dev/accounts \
    -H "Authorization: Bearer $NUVION_API_KEY"
  ```
</CodeGroup>

Requests without a valid key return a `401` error:

```json theme={null}
{
  "error": {
    "code": "unauthorized",
    "message": "No valid API key provided."
  }
}
```

Requests made with a key that lacks the required permissions return a `403` error:

```json theme={null}
{
  "error": {
    "code": "forbidden",
    "message": "Your API key does not have permission to perform this action."
  }
}
```

## Keeping keys secure

<Warning>
  API keys carry the same privileges as your account credentials. Never expose them in client-side code, public repositories, or logs.
</Warning>

* Store keys in environment variables or a secrets manager — never hardcode them.
* Rotate keys immediately if you suspect they have been compromised. You can do this from your dashboard without downtime by creating a new key before deleting the old one.
* Delete keys that are no longer in use.

## IP allowlisting

For webhook endpoints, Nuvion supports IP allowlisting to restrict inbound delivery to Nuvion's IP ranges only. Contact support to obtain the list of Nuvion IP addresses and configuration details.