The REST API authenticates with an API key.
API keys
Every request must include your API key in the x-api-key header:
What a key can reach
A key is issued to a person, within one organization. It acts as that person:
every request reaches exactly the events its owner can open in Nowadays, and
nothing else.
That matters for two reasons:
- Events are private to their creator and their approvers by default,
so a key does not see every event in the organization — only its owner’s.
- Events created through the API are owned by the key’s user, and their
visibility follows that person’s group memberships, exactly as if they had
created the event in the dashboard.
If you need an integration that spans several people’s events, issue a key to a
user who has been granted access to them.
Keys are issued by the Nowadays team; contact us
to obtain one.
A missing or invalid key returns 401 Unauthorized. See Errors
for the full status-code reference.
Keeping keys safe
Treat your key like a password. It is shown only once at creation, and it can
read and modify its owner’s events — including creating new ones.
- Store the key in a secret manager or environment variable — never commit it to
source control or expose it in client-side code.
- Rotate by requesting a new key and revoking the old one; revocation takes
effect immediately.
