Skip to content
Nyuchi Docs

API keys

API access for scripts, services, and integrations is managed through API keys—client ID and secret pairings created in the console. A key authenticates your application rather than a person, so it works without a signed-in user and never expires with a session.

Create a key

Section titled “Create a key”
  1. Sign in to the console at platform.nyuchi.com (all console sign-in is WorkOS AuthKit).
  2. Open the API keys area and create a new key.
  3. Copy both values immediately:
    • Client ID — starts with nyk_. Identifies the key; safe to log.
    • Client secret — starts with nys_. Shown once at creation; store it in a secret manager.

The gateway stores only a hash of the secret. If you lose it, revoke the key and create a new one—there is no recovery.

Send the key

Section titled “Send the key”

Two equivalent header forms are accepted on every request:

Terminal window
# Pair form
curl https://api.nyuchi.com/v1/news/articles \
  -H "X-Client-Id: nyk_..." \
  -H "X-Client-Secret: nys_..."


# Combined form
curl https://api.nyuchi.com/v1/news/articles \
  -H "X-API-Key: nyk_....nys_..."

Scope

Section titled “Scope”

Keys are scoped to the public product namespaces (news, weather, commerce, and the other published surfaces). Internal namespaces—admin, pay, and other first-party tooling—reject external keys regardless of the secret; those surfaces are only reachable through the console’s server-side proxy.

Register redirect URIs for hosted sign-in

Section titled “Register redirect URIs for hosted sign-in”

If your app uses WorkOS AuthKit sign-in (/v1/auth/workos/login), it needs its own return_to origin registered on its key—the gateway is a shared, multi-tenant endpoint and doesn’t hardcode any single app’s domain. Set redirect_uris when creating the key, or update them any time:

Terminal window
curl -X PATCH https://api.nyuchi.com/v1/api-keys/{key_id}/redirect-uris \
  -H "Authorization: Bearer $PLATFORM_JWT" \
  -H "Content-Type: application/json" \
  -d '{"redirect_uris": ["https://your-app.example/auth/callback"]}'

Then pass your client_id alongside return_to at /login—see Authentication.

Keys vs platform JWTs

Section titled “Keys vs platform JWTs”
Credential Identifies Use it for
Platform JWT (Authorization: Bearer …) A signed-in person (via WorkOS AuthKit) Acting on behalf of a user
API key (X-Client-Id/X-Client-Secret) Your application Server-to-server calls, cron jobs, integrations

Next steps

Section titled “Next steps”