Every request you make to the Nodepick API must include a valid API key. Nodepick uses Bearer token authentication — you pass your key in the Authorization header on each request. There are no session cookies or OAuth flows to manage; a single header is all you need.
Get Your API Key
To generate an API key, log in to the Nodepick dashboard and navigate to Developer Settings. Click Generate New Key, give it a descriptive name, and copy the value immediately — the full key is only shown once at creation time.
Pass Your Key on Every Request
Include your API key as a Bearer token in the Authorization header on every API call:
Never expose your API key in client-side code, public repositories, or anywhere outside of a secure server environment. Anyone who obtains your key can create and delete nodes on your account and incur charges on your behalf.
Use an Environment Variable
The safest way to handle your API key is to store it in an environment variable rather than hardcoding it in your source files. Set the variable in your shell:
Then read it at runtime in your application:
This approach keeps your key out of version control and lets you rotate it without touching your codebase.
Auth Error Responses
If a request fails due to an authentication problem, you will receive one of the following responses:
- 401 Unauthorized — Your API key is missing from the request or the value you provided is not a valid key. Double-check that you copied the full key from Developer Settings and that the
Authorization header is formatted exactly as Bearer YOUR_API_KEY.
- 403 Forbidden — Your API key is valid, but it does not have the permission scope required for the action you attempted. Review the key’s scopes in Developer Settings and update them if necessary.
Rotating Keys
If you suspect a key has been compromised, go to Developer Settings and generate a new key immediately. Update your applications to use the new key, then delete the old key from Developer Settings. Deletion is permanent — any request still using the old key will receive a 401 response. 
