API Authentication & Headers
The GN-Apex REST API utilizes a zero-trust cryptographic handshake model. All requests require strict header signatures, and keys are heavily scoped based on public vs. server-side execution environments.
“Separate your public client-side read keys from your master server-side write keys to guarantee absolute data sovereignty.”
Zero-Trust API Architecture
Instead of standard username/password basic auth, integration with the GN-Apex Control Plane requires Bearer Tokens generated directly from your project node.
Scoped Identity Keys
Keys dictate exact access privileges (e.g. content:read vs analytics:write) preventing token abuse.
Instant Revocation
If a key is compromised, administrators can toggle its status to inactive in the dashboard, dropping all inflight network requests instantly.
API Key Hierarchy & Scopes
Your workspace provisions two primary types of API keys, easily identifiable by their prefixes:
| Parameter | Type | Requirement | Description |
|---|---|---|---|
| nx_pk_live_... | Public Key | Optional | Safe to expose in browser environments (React, Next.js client components). Restricted exclusively to HTTP GET (content reads) and Analytics POST ingress. |
| nx_sk_live_... | Secret Key | Optional | Strictly reserved for server environments (Node.js, edge functions). Grants total read/write access, deployment triggers, and schema mutations. |
Required HTTP Headers
Every API request must pass the authorization token and the target project context:
| 1 | curl -X GET "https://api.gnapex.com/v1/content/prj_12345/globals" \ |
| 2 | -H "Authorization: Bearer nx_pk_live_a1b2c3d4e5f6" \ |
| 3 | -H "X-Nexus-Project: prj_12345" \ |
| 4 | -H "Content-Type: application/json" |
CORS & Origin Security
nx_pk_) from a browser are subjected to strict CORS (Cross-Origin Resource Sharing) evaluations. The origin domain must be verified and attached to the project node inside the GN-Apex dashboard, otherwise the Control Plane will reject the handshake with a 403 Forbidden status.