Skip to main content
All Nixflex API requests are authenticated with an API key pair: a key_id and a key_secret.

​
API key format

The key_id identifies your account. The key_secret is the password — you can reveal it again at any time from the API Keys page in the dashboard, so treat it like a database password.

​
Sending requests

Every API request must include an Authorization header in this exact format:
Both parts joined by a colon. Example:

​
Creating keys

In the dashboard:
1

Go to API Keys

Open app.nixflex.com → API Keys.
2

Create a new key

Click Create new key, name it (e.g. “Production”, “Staging”).
3

Copy your key

Copy the full key into your secrets manager. If you lose it, you can reveal it again from the API Keys page.
You can also create a key programmatically with POST /v1/keys. See Create API key.

​
Security

Never expose key_secret in client-side code, mobile apps, or public repositories. Anyone with the secret can make calls and rack up your bill. Treat it like a database password.
Contacting support? Send only your key_id (the nxf_ part). It identifies your account but cannot authenticate anything, so it is safe to share. Never include the key_secret (nxfs_) in an email or support ticket.
Best practices:
  • Store keys in environment variables or a secrets manager (1Password, AWS Secrets Manager, etc.)
  • Use separate keys for development, staging, and production
  • Rotate keys after team members leave
  • Revoke compromised keys immediately from the dashboard

​
Failed authentication

If your key is wrong, missing, or revoked, the API returns 401 Unauthorized:
Check that:
  • The Authorization header is present
  • The format is Bearer key_id:key_secret (note the colon, not a space)
  • The key has not been revoked in the dashboard
  • You are sending it to api.nixflex.com, not the engine’s internal hostname

​
Scoping

Every key is scoped to a single account. All agents, phone numbers, calls, and campaigns created with a key belong to that account and are isolated from other accounts. You cannot use one account’s key to access another account’s resources, even by guessing IDs.