API keys

The Nexus API authenticates every request with a publisher API key, sent in the X-SHARED-SECRET request header. A request with a missing, inactive, or wrong-type key is rejected with 401 Unauthorized.

GET /v1/attributions/creators HTTP/1.1
Host: api.nexus.gg
X-SHARED-SECRET: nexus_pk_your_key_here

Key types

A publisher admin mints keys in the Nexus Dashboard. There are two types, distinguished by prefix:

Type	Prefix	Use it for
Public	nexus_pk_…	Read endpoints (for example, listing creators).
Private	nexus_sk_…	Writes and sensitive reads (recording and updating attribution transactions).

Endpoints are gated by key type: a public-key request to a private endpoint returns 401, and a private key works wherever a public key does.

Both key types are secrets

A public key is not a publishable, browser-safe key. It is still a bearer secret that returns per-publisher data. Treat both nexus_pk_… and nexus_sk_… keys like passwords: never embed them in client-side code, never commit them, and never paste them into a shared tool. Rotate a key immediately if it is exposed.

Sandbox vs production

Point non-production testing at the sandbox host and keep production keys for production traffic.

Environment	Base URL
Production	https://api.nexus.gg
Sandbox	https://api.nexus-dev.gg

Tip

Mint separate keys for sandbox and production so test traffic and live traffic never share credentials, and point each environment at its own base URL above.