Authentication
API keys, OAuth client credentials, and what a key is allowed to reach.
Every authenticated request carries a bearer token in the Authorization header. There are two kinds, and they are interchangeable at the endpoint.
Any authenticated request
Authorization: Bearer nomi_sk_live_EXAMPLEAPI keys
An API key is created in the console under Settings, shown once, and stored only as a hash — there is no endpoint that returns it again. It starts with nomi_sk_live_ and belongs to one organisation. That is why no endpoint in this API takes an organisation parameter: the key already decided.
OAuth client credentials
POST /oauth/token with the client_credentials grant exchanges a client id and secret for a short-lived access token. It is the sturdier option for a long-running integration: the credential that sits in your configuration is exchanged rather than sent, and a leaked access token expires on its own.
POST/oauth/token
Exchange a client id and secret for a short-lived access token.
What needs no key
Public verification is deliberately unauthenticated: GET /public/credentials/{code} and GET /public/verify answer to anyone. A third party checking a diploma has no account with you and should not need one.