Authentication

Every request carries your API key as a bearer token, and every request goes to one base URL, https://api.noresponse.org.

Authorization: Bearer nrk_01JA2ZC0Q1R2S3T4V5W6X7Y8Z9_0123456789abcdefghijklmnopqrstuvwxyzABCDEFA

The key identifies your platform, so no request body names a tenant and the API refuses a body that includes one. The account_id in an assessment request is different: it is your own opaque id for the person’s account, and the request needs it.

Key format

A key is 74 characters in three parts.

Part	Example	Notes
Prefix	`nrk_`	Marks a NoResponse key, so secret scanners can find one.
Key id	`01JA2ZC0Q1R2S3T4V5W6X7Y8Z9`	26 characters. Public and safe to log.
Secret	`0123456789abcdefghijklmnopqrstuvwxyzABCDEFA`	43 characters after the second underscore. Shown once, when the key is created.

NoResponse stores a keyed hash of the secret. Logs and error responses carry the key id.

Where keys live

A key lives on your server, in your secret store or environment. The SDKs read it from NORESPONSE_API_KEY and keep it out of their string forms, error messages and logs.

Call NoResponse from the backend route that creates the account, after your auth provider has verified the session. Browser, mobile and desktop code goes through that route.

Scopes

Each key carries one or more scopes. An operation accepts any one of the scopes listed for it.

Scope	Grants
`assess`	`POST /v1/assessments`, `GET /v1/assessments/{assessment_id}` and `POST /v1/assessments/{assessment_id}/outcomes`.
`history`	`GET /v1/assessments/{assessment_id}` and `POST /v1/assessments/query`.
`webhooks`	Webhook endpoint registration, key rotation and deletion.
`detailed`	Adds `response_mode: "detailed"` to the three reads above. It is always used together with `assess` or `history`.

Ask for the narrowest key each part of your system needs. A signup route needs assess. A support tool that lists an account’s history needs history. assess can read an assessment by its id, so a signup service can poll what it created without being able to list an account’s history.

A key with the wrong scope answers 403 tenant_forbidden. A missing, malformed, revoked or expired key answers 401 unauthorized. Another platform’s assessment answers 404 not_found, never 403.

Rotate a key

POST /v1/keys/rotate mints a new key with the same scopes as the key that signs the request. The old key keeps working for an overlap window, so your fleet can switch keys with no failed request.

const rotation = await nr.keys.rotate({ overlapSeconds: 3600 });
await secretStore.write("NORESPONSE_API_KEY", rotation.key); // shown once
console.log(rotation.previousKeyExpiresAt);

rotation = client.keys.rotate(overlap_seconds=3600)
secret_store.write("NORESPONSE_API_KEY", rotation.key)  # shown once
print(rotation.previous_key_expires_at)

res, err := client.Keys.Rotate(ctx, components.KeyRotationRequest{OverlapSeconds: noresponse.Pointer(int64(3600))})
if err != nil {
  return err
}
rotation := res.Result
secretStore.Write("NORESPONSE_API_KEY", rotation.Key) // shown once
fmt.Println(rotation.PreviousKeyExpiresAt)

curl https://api.noresponse.org/v1/keys/rotate \
  -X POST \
  -H "Authorization: Bearer $NORESPONSE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "overlap_seconds": 3600 }'

overlap_seconds runs from 60 seconds to 7 days. Send {} to take the default of 24 hours. The answer is 201.

{
  "key": "nrk_01JA2ZC0Q1R2S3T4V5W6X7Y8Z9_0123456789abcdefghijklmnopqrstuvwxyzABCDEFA",
  "key_id": "01JA2ZC0Q1R2S3T4V5W6X7Y8Z9",
  "scopes": ["assess", "history"],
  "created_at": "2026-10-21T09:00:00.000Z",
  "previous_key_id": "01JA2Z8K6Q4V7W9XBCDEFGHJKM",
  "previous_key_expires_at": "2026-10-22T09:00:00.000Z"
}

key is the new credential and appears only in this answer. Both keys authenticate until previous_key_expires_at. After it, the old key answers 401 on every request.

To rotate without a failed request:

Call the endpoint with the current key.
Write key to your secret store before you do anything else.
Deploy, so every instance reads the new key.
Check before previous_key_expires_at that nothing still sends the old key.

Three rules apply.

A key accepts one rotation. Rotating a key that is already in its overlap window answers 409 key_rotation_in_progress. Rotate with the new key instead.
Rotation is not idempotent. The endpoint takes no Idempotency-Key, and a retry after a lost answer mints another key. If you lose the answer, email [email protected] and we revoke the key you never received.
Any scope can rotate its own key.