Autenticación
Aprenda cómo NovaAI autentica las solicitudes de API utilizando tokens de portador (bearer tokens). Esta guía explica el flujo de autenticación, los encabezados de solicitud requeridos y las prácticas de seguridad recomendadas para proteger sus credenciales en entornos de desarrollo y producción.
Overview
Every request sent to the NovaAI API must be authenticated before it can access models, files, or other platform resources. Authentication is performed using a Bearer Token, which identifies your project and authorizes access to the requested endpoint.
Requests without valid authentication credentials will be rejected with an appropriate HTTP status code.
Authentication Flow
NovaAI follows a simple authentication process before processing any request.
Authorization Header
Include your API key in the Authorization header using the Bearer authentication scheme.
Authorization: Bearer YOUR_API_KEY
Every authenticated request should also include the appropriate content type.
Content-Type: application/json
Example Request Headers
Header | Required | Description |
|---|---|---|
Authorization | Yes | Bearer token used to authenticate the request. |
Content-Type | Yes | Specifies the request body format. |
Accept | Optional | Defines the preferred response format. |
Authentication Example
If authentication succeeds, NovaAI will continue processing the request. Otherwise, an error response is returned immediately.
Authentication Lifecycle
Authentication Status Codes
Status Code | Meaning | Description |
|---|---|---|
200 | OK | Authentication succeeded and the request was processed. |
401 | Unauthorized | Missing, invalid, or expired authentication credentials. |
403 | Forbidden | Authenticated successfully, but the requested resource is not accessible. |
Security Best Practices
Protecting your API credentials is essential for maintaining a secure application.
Store API keys using environment variables.
Never expose secret keys in frontend applications.
Rotate credentials regularly.
Generate separate keys for development and production.
Use HTTPS for every request.
Restrict API keys to trusted environments whenever possible.
Common Authentication Errors
Missing Authorization Header
Occurs when the request is sent without an Authorization header.
- Solution
Add the bearer token to every authenticated request.
Invalid API Key
Occurs when the supplied API key does not exist or has been revoked.
- Solution
Generate a new API key from the Developer Dashboard and update your environment variables.
Expired Credentials
Some temporary credentials may expire after a predefined period.
- Solution
Refresh the credentials and retry the request.