Skip to main content

​
Authentication

All /v1 requests require an nOps API key in the Authorization header:

​
Creating keys

  1. Sign in to nOps as an organization admin on Inform + Operate.
  2. Open Settings → Security → API Keys.
  3. Create a key and assign the permissions your integration needs.
  4. Copy the key when shown. It is only displayed once.

​
Security rules

  • Keys are never accepted in query parameters.
  • Session cookies are not used on /v1. Auth is header-only.
  • Keys are scoped to your nOps organization and cannot be used across tenants.

​
Scopes

When creating an API key, assign the permissions your integration needs in Settings → Security → API Keys. mcp:read and mcp:write gate the Clara MCP agent surface; they do not authorize API-key /v1 calls. Use the granular scopes above for programmatic API access.

​
Data visibility

An API key sees all of your organization’s data for the permissions you assign to it. For example, budgets:read lets the key read every budget, and budgets:write lets it edit every budget. To limit a key to the data a role can see, name the key rbac:<role-slug>. Replace <role-slug> with the slug of that role. The key then uses that role’s data scope. If the role’s data scope is not set up, requests with that key return 403 with the error code forbidden_scope. The Clara MCP scopes (mcp:read / mcp:write) are not affected. They still use the access of the signed-in user.