Overview

Authentication

Create a key and send it with every request.

Every request needs a key. There are no sessions and no sign-in with user name and password.

Create a key

In the platform, go to Settings → API keys and click New key. This requires admin rights in the space. A key belongs to exactly one space and can only act in that space.

The key is shown exactly once. Copy it right away and keep it wherever you keep other credentials. If it gets lost, create a new one and delete the old one.

Send it

The key goes into the Authorization header as a Bearer token. Keys start with np_.

curl https://app.elunos.ai/api/v1/spaces \
  -H "Authorization: Bearer np_xxxxxxxx"

The response names the space the key belongs to. Put its slug into every address under /spaces/{space}.

Without a valid key

If the key is missing, wrong or deleted, the API answers 401:

{
  "code": "unauthenticated",
  "message": "Pass your API key as a Bearer token."
}

A call in another space ends with 403 forbidden.

Limits

60 requests per minute per key. Every response carries X-RateLimit-Limit and X-RateLimit-Remaining. Above the limit you get 429, and the Retry-After header says how many seconds to wait. Plan bulk imports with a short pause between calls.

The key belongs on your server, not in a web page or an app. Whoever holds it can change agents, read conversations and delete knowledge.