Authentication
The Data Access API uses API keys for authentication. Keys are only sent via the Authorization header.
Header Format
Authorization: Bearer nfk_live_XXXXXXXXXXXX_YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYKey Format
Keys follow the format: nfk_(live|test)_<12>_<43>
Important Notes
- Only
Authorization: Beareris accepted. Query parameters like?key=or?apiKey=are rejected. - Keys are validated with timing-safe HMAC-SHA256 using a server pepper.
- Keys can be revoked at any time from your workspace. Revoked keys return
401 Unauthorized. - Each key is shown only once at creation — store it securely.
Scopes
| Scope | Access |
|---|---|
| forms:read | List and view forms |
| responses:read | List and view responses (no PII by default) |
| payments:read | List payments derived from responses |