Authentication

All requests to the Norbelys API require an org-scoped API key. Keys are tied to a single organization (workspace) — they can only read and write data within that org.

Creating a key

Open the Norbelys dashboard and navigate to Settings → API keys.
Click Create key, give it a name, and copy the value immediately — it is shown only once.

Keys start with ak_live_… for production.

Using your key

Send the key as a bearer token in the Authorization header:

GET https://api.norbelys.com/v1/contacts
Authorization: Bearer ak_live_…

All major HTTP clients support bearer tokens:

curl https://api.norbelys.com/v1/contacts \
  -H "Authorization: Bearer ak_live_…"

const response = await fetch("https://api.norbelys.com/v1/contacts", {
  headers: {
    Authorization: "Bearer ak_live_…",
  },
});
const { data } = await response.json();

import httpx

client = httpx.Client(
    base_url="https://api.norbelys.com/v1",
    headers={"Authorization": "Bearer ak_live_…"},
)
contacts = client.get("/contacts").json()

Error responses

Missing or invalid keys return a 401:

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid API key."
  }
}

All errors follow the same shape with the matching HTTP status code.

Key security

Store keys in environment variables, never in source code.
Rotate keys in Settings → API keys if one is compromised.
Keys carry full org-level write access — treat them like passwords.

Get started

Reference

Creating a key

Using your key

Error responses

Key security

​Creating a key

​Using your key

​Error responses

​Key security

Creating a key

Using your key

Error responses

Key security