# Authentication

> How API keys and dashboard sessions work.

Nordva Launch uses two distinct credentials. They are not interchangeable.

## API keys (product endpoints)

All endpoints under `/v1/` that operate on **your project's data** authenticate with an API key:

```
Authorization: Bearer nv_live_<32 hex characters>
```

- Format: `nv_live_` + 32 hex characters for a secret key, `nv_pub_live_` + 32 hex characters for a browser-safe publishable key. Older `sk_live_` keys keep working.
- Storage: bcrypt-hashed with a server-side pepper. Plaintext is shown once at creation.
- Scope: project-level. Each key belongs to exactly one project, so a request never has to say which project it means. See [Projects](/projects/).
- Revocation: immediate. Subsequent requests with a revoked key receive `REVOKED_API_KEY` (401).

Create, name, and revoke keys at [`Dashboard → API Keys`](https://app.nordva.dev/api-keys).

## Clerk JWTs (dashboard endpoints)

Endpoints called by the dashboard itself (`/v1/auth/provision`, `/v1/overview`, `/v1/api-keys`, `/v1/billing/*`) authenticate with a Clerk RS256 JWT instead. JWTs are issued by Clerk after a successful sign-in and verified server-side against Clerk’s JWKS.

If you send a Clerk JWT to a product endpoint (or an API key to a dashboard endpoint), the server responds with `WRONG_AUTH_TYPE` (401). This is intentional: it stops accidental privilege escalation in either direction.

## Rotation

We recommend rotating keys quarterly, and immediately after any suspected leak:

1. Open `Dashboard → API Keys`.
2. Create a new key.
3. Deploy the new key to your application.
4. Revoke the old key.

Because revocation is immediate, deploy the new key first.

Source: https://docs.nordva.dev/authentication/