API keys

The Nexus API authenticates every request with a publisher API key, sent in the X-SHARED-SECRET request header. A request with a missing, inactive, or wrong-type key is rejected with 401 Unauthorized.

GET /v1/attributions/creators HTTP/1.1
Host: api.nexus.gg
X-SHARED-SECRET: nexus_pk_your_key_here

Key types

A publisher admin mints keys in the Nexus Dashboard. There are two types, distinguished by prefix:

Type	Prefix	Use it for
Public	nexus_pk_…	Reads your game client makes (for example, validating a creator code). Ships in the client.
Private	nexus_sk_…	Writes and sensitive reads (recording and updating attribution transactions). Server-side only.

Endpoints are gated by key type, and the gate works in both directions: a key of the wrong type returns 401. A private key is rejected by an endpoint that takes a public key, so send each endpoint the key type its reference names.

The public key ships in your game client

A public key is meant to be embedded in your game client. It can only call the read endpoints a game needs, such as validating a creator code or listing your program’s creators. Those endpoints return data for showing to players. Assume players can extract it, and use a program-scoped public key so a client reads only its own program.

The private key stays on your server

A private key records and changes attribution data, and reads your sales. Keep it on your server: never ship it in a game client, never commit it, and never paste it into a shared tool. Rotate it immediately if it is exposed.

Save your key when you create it

Copy and securely save each key before closing the creation dialog. Both public and private keys are shown only once. The Developer settings list shows key metadata but cannot reveal the key. Existing keys continue to work. If you lose one, create a replacement, update your integration, and delete the old key. Send the original key in X-SHARED-SECRET; do not hash it yourself.

Sandbox vs production

Point non-production testing at the sandbox host and keep production keys for production traffic.

Environment	Base URL
Production	https://api.nexus.gg
Sandbox	https://api.nexus-dev.gg

Tip

Mint separate keys for sandbox and production so test traffic and live traffic never share credentials, and point each environment at its own base URL above.