Authentication

Nordva Launch uses two distinct credentials. They are not interchangeable.

API keys (product endpoints)

All endpoints under /v1/ that operate on your project’s data authenticate with an API key:

Authorization: Bearer nv_live_<32 hex characters>

• Format: nv_live_ + 32 hex characters for a secret key, nv_pub_live_ + 32 hex characters for a browser-safe publishable key. Older sk_live_ keys keep working.
• Storage: bcrypt-hashed with a server-side pepper. Plaintext is shown once at creation.
• Scope: project-level. Each key belongs to exactly one project, so a request never has to say which project it means. See Projects.
• Revocation: immediate. Subsequent requests with a revoked key receive REVOKED_API_KEY (401).

Create, name, and revoke keys at Dashboard → API Keys.

Clerk JWTs (dashboard endpoints)

Endpoints called by the dashboard itself — /v1/auth/provision, /v1/overview, /v1/api-keys, /v1/billing/* — authenticate with a Clerk RS256 JWT instead. JWTs are issued by Clerk after a successful sign-in and verified server-side against Clerk’s JWKS.

If you send a Clerk JWT to a product endpoint (or an API key to a dashboard endpoint), the server responds with WRONG_AUTH_TYPE (401). This is intentional — it stops accidental privilege escalation in either direction.

Rotation

We recommend rotating keys quarterly, and immediately after any suspected leak:

1. Open Dashboard → API Keys.
2. Create a new key.
3. Deploy the new key to your application.
4. Revoke the old key.

Because revocation is immediate, deploy the new key first.