Get started
Keys carry the owner's authority
One secret, sent on every request. What it can reach is decided by what you own, not by anything stored on the key.
Sending your key
Keys are made on your nyx profile page and start with nyx_live_. A key reaches the servers you own where nyx+ is active, by subscription or override. Handing it to your own developer is fine: it carries your authority and nothing else. Send it either way:
Authorization: Bearer nyx_live_...
# or
X-Api-Key: nyx_live_...Scope is live, never stored
Every request works out again what the key may read. Revoking a key stops it at once. Losing nyx+ or transferring a server drops that server out of reach within a minute, with no change to the key. Turning a plugin off makes its endpoints answer 409 PLUGIN_DISABLED just as quickly.
Keep it server-side
Treat the key like a password. Never ship it in code that runs in visitors' browsers, where anyone can read it; call the API from your own backend instead. The nyx_live_ prefix is there so secret scanners can catch an accidental commit.