API Authorization

API Authorization Guide

Every request to the NLPearl API must carry an Authorization header. There are two kinds of credential behind it, and both are accepted on every /v2 endpoint - so an integration built against one works against the other without changing a single call.

API Secret Key

One key with full access to your workspace. Best for your own backend code.

OAuth 2.0

An app with its own client ID and secret, limited to the scopes you grant and rotatable on its own. Best for a third-party integration.

Choosing Between Them

	API secret key	OAuth 2.0 app
What you send	`Bearer AccountId:SecretKey` on every call	`Bearer <access_token>`, after requesting a token
Reach	The whole workspace, always	Only the scopes you granted the app
Lifetime	The key does not expire	Access tokens last one hour; request a new one when they expire
If the secret leaks	Delete the key and create a new one	Rotate the app’s secret; its client ID and scopes stay as they are
Readable again later	Yes, copy it from the credentials list	No, the client secret is shown once

Both are created on the API Access page of your workspace settings, and creating either one requires an active subscription.

Getting Started

API V2

API V1