Set up the REST API

Every NimbusNexus product is a REST API: JSON over HTTPS, with your API key in the Authorization header. This page takes you from no key to a first successful call. Pick a language at the top of the page and the examples follow it. REST means curl; TypeScript, Python and Go use each language's usual HTTP client, with no SDK needed.

1 · Get an API key

Apps: Webhooks, Inboxes and QR Codes. Open API keys in your account console and create a key for the product you want to call. Each key belongs to one product. Choose its scope there: admin, read, or for Webhooks also publish. Copy the key when it appears, because it is shown only once. An app key is a JWT, so it starts with eyJ.

Infrastructure: VMs, storage, databases and networking. Create the key in the dashboard under Settings → API keys. It is scoped to one project. Authentication covers scopes and rotation.

Keep the key out of your source code. Export it in your shell or keep it in your secret store:

export WEBHOOKS_API_KEY="<your-api-key>"

2 · Send it on every request

Send the key as a bearer token. The app APIs also accept it as X-API-Key: <key>.

Authorization: Bearer <your-api-key>

Each product has its own base URL:

3 · Make a first call

GET /v1/auth/me on Webhooks returns the key you sent: its scope and the workspace it belongs to. It reads nothing else, so any valid key can call it.

curl https://webhooks.nimbusnexus.net/v1/auth/me \
  -H "Authorization: Bearer $WEBHOOKS_API_KEY"

The response names your workspace:

{
  "scope": "admin",
  "workspace_id": "<workspace-id>"
}

The other fields say what kind of credential this is. For an API key, email and created_at are null.

4 · Read errors

A failed request answers with a 4xx or 5xx status and one error shape across every product:

{
  "error": {
    "code": "unauthorized",
    "message": "…",
    "details": { "reason": "missing" },
    "request_id": "…"
  }
}

Branch on code, not on the status or the message. unauthorized means no key arrived or the key was revoked. invalid_credential means the key is not valid: mint a new one, because retrying will not help. forbidden means the key is valid but cannot do this: its scope or role is missing, or the product is not enabled for your workspace. Authentication and Errors list every code. Quote the request_id when you contact support.

What's next

• API reference: every operation of every product, with the call in your language.
• SDKs and the CLI: the same calls with retries, signature checks and pagination handled for you.
• Product quickstarts: Webhooks, Inboxes, your first VM.