Authentication

Calls to POST /v1/analyze use a workspace API key.

Send the key

Include the key in the Authorization header on every request.

Text

Authorization: Bearer sk_bact_your_key

Integration authentication

Signed integration deliveries use a receiver-specific signing secret instead of an API key. See the integrations guide for the receiver URL and signature requirements.

Create, rotate, or revoke a key

Create a replacement key before revoking the old one to rotate without downtime. Revoked keys immediately receive 401. Workspace administrators manage keys in Settings / API Keys.

Keep keys secret

Call Nyeti from your backend. Do not put an API key in browser or mobile application code, commit it to source control, or include it in client-visible logs.