Overview

The NOAH Business API uses both an API Key and Request Signing to authenticate requests, ensuring secure communication between your system and our API.

Keys

There are three important security keys required to work with NOAH's API:

Name	Description
API Key	Used to identify and authenticate your requests.
Request Signing Private Key	Used by your system to sign requests. Never share this key.
Request Signing Public Key	Used when creating API Keys and later by our API for request signature verification.

Headers

Every request to our API must include the following headers:

Header	Description
X-Api-Key	Contains your API Key created in the NOAH Dashboard.
Api-Signature	Contains a JWT (JSON Web Token) with claims related to your request, signed using your Request Signing Private Key.

Security of your Funds

Never send us nor share your Request Signing Private Key. It should be securely stored in your system and never exposed publicly.

Details

To get started with API keys and Request Signing Kets, see the below:

• API Keys
• Request Signing Keys

Error Handling

A 401 Unauthorized HTTP status code will be returned in the following scenarios:

• Missing Credentials:
  • Requests made over plain HTTP.
  • Requests with missing X-Api-Key header.
• Invalid Credentials:
  • Requests with invalid or expired API Keys.
  • Requests with invalid or expired signed JWTs.
• Environment Mismatch:
  • Requests made using an API Key with a mismatched env value.
• Signature Issues:
  • Requests in prod with missing Api-Signature header.
  • Requests in sandbox with missing Api-Signature header when using an API Key associated with a Request Signing Public Key.
• Unauthorized Access:
  • Requests made from a browser using the X-Api-Key header.