NoCam APIAuthentication
One header on every call.
Send your key on every call:
Authorization: Bearer nc_live_abc123…GET /v1/models, GET /v1/models/{id} and GET /v1/openapi.json are open and need no key.
Two kinds of key
| Starts with | What it does |
|---|---|
nc_live_ | Runs real models and spends credits |
nc_test_ | The sandbox: sample results, no credits |
What a key can be limited to
Whoever makes the key can set:
| Limit | What happens past it |
|---|---|
Permissions (models:read, generations:read, generations:write, uploads:write, account:read) | missing_scope |
| A spend limit per day, week, month or in total | spend_limit_reached |
| A list of models | model_not_allowed |
| A list of addresses | ip_not_allowed |
| An expiry date | expired_api_key |
Give an AI agent its own key with a spend limit. If it goes wrong, the damage has a ceiling, and you can revoke that key alone.
Keeping it safe
- Keep it in an environment variable, never in code or in a chat.
- A browser page can't keep a secret: call the API from your server.
- A key's fixed prefix lets secret scanners spot a leak. If one leaks, have it revoked: it stops working at once.
We store only a keyed hash of each key, so a lost key can't be shown again. You get a new one.