> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nozle.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Public catalog and trusted-backend credentials

## Base URLs

| Base URL                        | Endpoints                                                                         |
| ------------------------------- | --------------------------------------------------------------------------------- |
| `https://api.nozle.app/api/v1`  | Entitlements, checkout, margin, credits, and Nozle intelligence APIs              |
| `https://core.nozle.app/api/v1` | Customers, events, plans, subscriptions, invoices, wallets, and billing resources |

## Credential model

| Key type    | Prefix      | Location        | Access                                                                 |
| ----------- | ----------- | --------------- | ---------------------------------------------------------------------- |
| Publishable | `pk_nozle_` | Browser         | `GET /api/v1/plans` only                                               |
| Secret      | `sk_nozle_` | Trusted backend | Organization-scoped server operations allowed by the key's permissions |

Send server credentials as a Bearer token:

```http theme={null}
Authorization: Bearer sk_nozle_your_secret_key
```

The publishable-key boundary is unconditional: customer reads and mutations return HTTP 403 even if a browser supplies an arbitrary customer ID. Use an authenticated merchant backend for checkout, invoices, subscription status, cancellation, top-ups, entitlements, and credits. That backend derives the Nozle customer from the logged-in user or team and calls Nozle with a least-privilege `sk_`.

<Warning>
  Never expose a secret or master key in client-side code. CORS and `Origin` headers do not authenticate a caller.
</Warning>

## Public authentication endpoints

* `POST /api/v1/auth/send-otp`
* `POST /api/v1/auth/verify-otp`
* `POST /api/v1/auth/signup`

Get API keys from [app.nozle.app](https://app.nozle.app) under **Settings → API Keys**.