Skip to main content
Handing access to someone else? An OAuth 2.0 app has its own client ID and secret, reaches only the scopes you grant it, and can be rotated on its own - see OAuth 2.0.

​
Overview

An API secret key is the simplest way to call the NLPearl API: one key, created in your workspace settings, sent on every request. It carries full access to the workspace, which makes it the right credential for code you own and run yourself, and the wrong one to give to a third party.
API keys live on the API Access page of your workspace settings. Creating one requires an active subscription.

​
Creating an API Key

1

Open the API Access page

Click your profile card at the bottom-left corner of the sidebar, open Settings, then select API Access in the settings menu. You can also go there directly: platform.nlpearl.ai/app/settings/api.
2

Open Add API Key

Click Create API Key. The window that opens holds a Name and the Secret Key itself.
3

Name it and copy the key

Give it a name that identifies where the key will be used - up to 15 characters - then copy the secret key with the button at the end of the field.
4

Create the key

Click Create Key. The key appears in the credentials list, marked with a key glyph and showing its first characters.
You can copy a key again at any time with the copy button on its row, and the delete button revokes it immediately.
A secret key carries full access to your workspace and cannot be restricted to part of it. Keep it server-side, never ship it in a browser, a mobile app or a public repository, and never share it with a third party - create an OAuth 2.0 app for that instead.

​
Finding Your Account ID

The header carries two values: your Account ID and the secret key. The Account ID identifies your workspace and is on the General Settings page of your workspace settings, under that name. It is also shown, with a copy button, in the workspace switcher.

​
Authorization Header

Send both values as a bearer token, separated by a colon:
For example:

​
Example request

Replace 66552698d60e456235eae520 with your Account ID and tWPqr5EEZv2dxqutv58NsCg7NuqGc1tX with your secret key.
The key does not expire and there is no token to request first: send the same header on every call. Deleting the key on the API Access page is what ends its access.

​
Errors