Authentication

The public API is authenticated with a bearer API key. The dashboard is authenticated with a session cookie. They're separate mechanisms — neither one weakens the other.

API keys (public API)

Send your key as a standard bearer token on every request:

bash

curl "https://api.nexus.chaitanya-bajpai.xyz/v1/knowledge-bases/kb_123/documents" \
  -H "Authorization: Bearer rk_live_..."

A key resolves directly to the organization it belongs to — there's no separate organization ID to pass alongside it, and no way for a request authenticated with one organization's key to reach another organization's data, regardless of what IDs appear in the URL. An invalid, revoked, or expired key all return the same 401 UNAUTHORIZED — the response deliberately doesn't distinguish which case you hit.

Session cookies (dashboard)

The dashboard signs in with email + a one-time code (or Google, if your organization has it enabled) and authenticates every subsequent request with an httpOnly session cookie — not a token your own code should ever generate or forward. If you're integrating programmatically, use an API key instead.

Error shape

Every error from the API — auth failures included — has the same shape:

json

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Authentication required"
  }
}