Use participant-scoped API keys

Create sandbox keys in the developer portal, then send them in the Authorization header from your server.

Sandbox keys

Sandbox keys start with nvt_sandbox_. Each key belongs to the participant you picked in the portal, and it can only do what the scopes you chose at creation allow.

Manage sandbox API keys

Authorization header

Code sample

Authorization: Bearer nvt_sandbox_your_key

Available scopes

transactions:writeInitiate and cancel transactions for the participant.

transactions:readRead the participant's transactions.

balances:readRead account balances.

reserves:readRead reserve information.

Rotate or revoke a key

To rotate a key, create a new one, update the secret in your deployment, check it works, and then revoke the old key in the sandbox portal. If a key is ever exposed, revoke it immediately. We can't recover a secret after it's been created.