Information
- OpenAPI version:
3.1.0
Overview
NimbusMint Partner API 1.0.0
Section titled “NimbusMint Partner API 1.0.0”Read-only API for NimbusMint partners. Every request is made with a private key issued by NimbusMint; the data it returns is scoped to the partner the key belongs to, never to anything named in the request.
Keys. A private key is a secret for your servers only. Never ship it in a browser, mobile app, bot client or any code a user can read. Each key is bound to an IP allowlist (your servers’ public egress addresses), has scopes, a rate limit and a hard expiry of at most one year. A revoked key stops working within 10 seconds. Request a key by opening a ticket in the NimbusMint Discord.
Request signing. Keys today authenticate with a bearer token. Signed requests (Ed25519 over the method, path, body hash, timestamp and nonce) are planned as an additional scheme; bearer keys keep working.
Errors. Every error is JSON {code, message}. Branch on code;
message is for humans and may change. Authentication failures are
always 401 invalid_key, whatever the reason.
Versioning. Changes within v1 are additive only: new optional fields, new routes, new error codes. Ignore fields you do not know.
Authentication
Section titled “Authentication”privateKey
Section titled “privateKey”Authorization: Bearer nmk_live_<id>_<secret>: <id> is 12
characters (the key id shown to you is nmk_<id>), <secret> 64 hex
characters. The full token is shown once, when the key is issued; we
store only a hash of it and cannot show it again.
The key works only from the addresses on its IP allowlist (public
IPv4 /24 or narrower, IPv6 /48 or narrower, at most 16 entries). It
expires on its expires_at (at most one year after issue), and a
revoked key stops working within 10 seconds. Keep it on your servers;
never put it in a client.
Security scheme type: http
Bearer format: nmk_live_<id>_<secret>