API keys

An API key authenticates every request as a Bearer token (see Authentication). Keys come in two classes:

Class	Can do
Usage	Submit nesting requests. The default.
Admin	Everything a Usage key can, plus manage the account’s keys, browser origins, and fairness.

The management endpoints on this page require an Admin key (or the account owner signed in to the dashboard). A Usage key calling them is rejected.

Managing keys

The full key lifecycle is API-callable, so you can issue a key per customer from your own onboarding flow rather than working through the dashboard.

Endpoint	Method	Purpose
`/admin/keys`	GET	List the account’s keys, including expired ones, with their type and fairness weight
`/admin/keys`	POST	Create a key
`/admin/keys/{ApiKeyId}`	DELETE	Revoke a key
`/admin/keys/{ApiKeyId}/regenerate`	POST	Rotate a key’s secret
`/admin/keys/{ApiKeyId}/type`	PATCH	Change a key between Usage and Admin
`/admin/keys/{ApiKeyId}/weight`	PATCH	Set the key’s fairness weight

Listing keys

curl https://dev.api.nestapi.com/admin/keys \
  -H "Authorization: Bearer YOUR_ADMIN_KEY"

The list includes keys that have expired, so you can see and revoke them. Revoked keys are not listed. Each ClientKey carries two flags:

Field	Notes
`Expired`	`true` once the key’s `Expires` date has passed. An expired key is rejected on every request.
`IsActive`	`true` when the key is neither expired nor revoked. Filter on this to find the keys that still work.

Creating a key

curl https://dev.api.nestapi.com/admin/keys \
  -X POST \
  -H "Authorization: Bearer YOUR_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "Reference":   "acme-corp",
    "Email":       "ops@acme.example.com",
    "KeyType":     "Usage",
    "Parallelism": 2,
    "Expires":     "2027-01-01T00:00:00Z"
  }'

Field	Notes
`Reference`	Your own identifier for the key — typically the customer it belongs to.
`Email`	Contact address associated with the key.
`KeyType`	`Usage` (default) or `Admin`.
`Parallelism`	How many nests this key may run concurrently.
`Expires`	Optional expiry. Omit for a key that never expires.
`Trial`	Request a time-boxed trial key (only meaningful on a paid plan).

The response is a ClientKey carrying the new ApiKey secret. Store it when you receive it. Key creation is subject to your plan’s active-key cap. Expired and revoked keys don’t count towards it.

Rotating a key

curl https://dev.api.nestapi.com/admin/keys/THE_KEY_ID/regenerate \
  -X POST \
  -H "Authorization: Bearer YOUR_ADMIN_KEY"

Regeneration carries the key’s reference, expiry, type, parallelism, fairness weight, and allowed origins forward onto the new secret.

The old secret stops working immediately — there is no overlap window. Update the integration with the returned key as part of the same operation.

Revoking a key

curl https://dev.api.nestapi.com/admin/keys/THE_KEY_ID \
  -X DELETE \
  -H "Authorization: Bearer YOUR_ADMIN_KEY"

To check a key you already hold — validity and expiry — see Identity & key status.

Browser origins (CORS)

For a key used from a browser, restrict which origins may call the API with it. Origins are matched exactly — scheme, host, and (non-default) port must all match.

Endpoint	Method	Purpose
`/apikeys/{KeyId}/origins`	GET	List allowed origins
`/apikeys/{KeyId}/origins`	POST	Add an allowed origin
`/apikeys/{KeyId}/origins`	DELETE	Remove an allowed origin

curl https://dev.api.nestapi.com/apikeys/YOUR_KEY_ID/origins \
  -X POST \
  -H "Authorization: Bearer YOUR_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "Origin": "https://app.example.com" }'

For local development add your dev server’s exact origin, e.g. http://localhost:3000 — http://localhost:3000, https://localhost:3000, and http://localhost:5173 are all distinct.

Keep long-lived keys server-side. Never ship an unrestricted key in browser or mobile code.

Getting Started

Guides

Concepts

Account

API Reference

Managing keys

Listing keys

Creating a key

Rotating a key

Revoking a key

Browser origins (CORS)

​Managing keys

​Listing keys

​Creating a key

​Rotating a key

​Revoking a key

​Browser origins (CORS)

Managing keys

Listing keys

Creating a key

Rotating a key

Revoking a key

Browser origins (CORS)