# API keys

How to authenticate to the Nexus API with publisher API keys.

The Nexus API authenticates every request with a **publisher API key**, sent in the
`X-SHARED-SECRET` request header. A request with a missing, inactive, or wrong-type key is rejected
with `401 Unauthorized`.

```http
GET /v1/attributions/creators HTTP/1.1
Host: api.nexus.gg
X-SHARED-SECRET: nexus_pk_your_key_here
```

## Key types

A publisher admin mints keys in the Nexus Dashboard. There are two types, distinguished by prefix:

| Type    | Prefix       | Use it for                                                                 |
| ------- | ------------ | -------------------------------------------------------------------------- |
| Public  | `nexus_pk_…` | Read endpoints (for example, listing creators).                            |
| Private | `nexus_sk_…` | Writes and sensitive reads (recording and updating attribution transactions). |

Endpoints are gated by key type: a public-key request to a private endpoint returns `401`, and a
private key works wherever a public key does.

<Aside type="danger" title="Both key types are secrets">
A **public** key is not a publishable, browser-safe key. It is still a bearer secret that returns
per-publisher data. Treat both `nexus_pk_…` and `nexus_sk_…` keys like passwords: never embed them
in client-side code, never commit them, and never paste them into a shared tool. Rotate a key
immediately if it is exposed.
</Aside>

## Sandbox vs production

Point non-production testing at the sandbox host and keep production keys for production traffic.

| Environment | Base URL                  |
| ----------- | ------------------------- |
| Production  | `https://api.nexus.gg`    |
| Sandbox     | `https://api.nexus-dev.gg`|

<Aside type="tip">
Mint separate keys for sandbox and production so test traffic and live traffic never share
credentials, and point each environment at its own base URL above.
</Aside>