Authentication

API key (REST + MCP)

Every Public API request requires:

X-API-Key: sk_live_…

On POST / PATCH with a JSON body, also send Content-Type: application/json.

API keys use the sk_live_… prefix. Create them in the dashboard at /api-mcp.

REST does not accept Authorization: Bearer sk_… — only X-API-Key. (MCP accepts Bearer; see MCP.)

Hosts

White-label vanity API/MCP hosts may exist for agencies; they must not advertise docs.notiq.io on vanity MCP discovery.

Create and manage keys (dashboard)

Keys are created in the product UI at /api-mcp (not via REST).

1. Open API & MCP in the app: app.notiq.io/api-mcp.
2. Create a key — the full secret is shown once; store it securely.
3. Subsequent list views show prefix / last four only.
4. Delete a key to revoke immediately.
5. Paid workspace (or eligible white-label member access) is required; otherwise REST returns 403 plan_required.
6. Defaults: up to 5 API keys and 5 webhooks per workspace (product may raise limits).

Webhook subscriptions are also created/edited/deleted only from /api-mcp (not REST). Optional signing secret length: 8–256 characters.

MCP auth modes

See MCP for the full resolution order (X-API-Key, Bearer sk_…, OAuth access token). MCP always forwards to REST as X-API-Key only.

Auth errors