Authentication

Overview

Application Workflows

Billing Resources

Usage & Metering

Invoicing & Payments

Platform & Operations

Base URLs

Base URL	Endpoints
`https://api.nozle.app/api/v1`	Entitlements, checkout, margin, credits, and Nozle intelligence APIs
`https://core.nozle.app/api/v1`	Customers, events, plans, subscriptions, invoices, wallets, and billing resources

Credential model

Key type	Prefix	Location	Access
Publishable	`pk_nozle_`	Browser	`GET /api/v1/plans` only
Secret	`sk_nozle_`	Trusted backend	Organization-scoped server operations allowed by the key’s permissions

Send server credentials as a Bearer token:

Authorization: Bearer sk_nozle_your_secret_key

The publishable-key boundary is unconditional: customer reads and mutations return HTTP 403 even if a browser supplies an arbitrary customer ID. Use an authenticated merchant backend for checkout, invoices, subscription status, cancellation, top-ups, entitlements, and credits. That backend derives the Nozle customer from the logged-in user or team and calls Nozle with a least-privilege sk_.

Never expose a secret or master key in client-side code. CORS and Origin headers do not authenticate a caller.

Public authentication endpoints

POST /api/v1/auth/send-otp
POST /api/v1/auth/verify-otp
POST /api/v1/auth/signup

Get API keys from app.nozle.app under Settings → API Keys.

​Base URLs

​Credential model

​Public authentication endpoints

Base URLs

Credential model

Public authentication endpoints