Skip to main content
The REST API authenticates with an API key.

​
API keys

Every request must include your API key in the x-api-key header:

​
What a key can reach

A key is issued to a person, within one organization. It acts as that person: every request reaches exactly the events its owner can open in Nowadays, and nothing else. That matters for two reasons:
  • Events are private to their creator and their approvers by default, so a key does not see every event in the organization — only its owner’s.
  • Events created through the API are owned by the key’s user, and their visibility follows that person’s group memberships, exactly as if they had created the event in the dashboard.
If you need an integration that spans several people’s events, issue a key to a user who has been granted access to them. Keys are issued by the Nowadays team; contact us to obtain one. A missing or invalid key returns 401 Unauthorized. See Errors for the full status-code reference.

​
Keeping keys safe

Treat your key like a password. It is shown only once at creation, and it can read and modify its owner’s events — including creating new ones.
  • Store the key in a secret manager or environment variable — never commit it to source control or expose it in client-side code.
  • Rotate by requesting a new key and revoking the old one; revocation takes effect immediately.