API Keys

How requests to Norien are identified today, and what arrives with authentication.

Your keys

No keys issued

Key management arrives with authentication. Until then the registry identifies callers by handle rather than by a verified secret — issuing a key here would hand you a credential that authorises nothing.

Current behaviour

Mechanism: x-norien-actor
Verification: not enforced
Bearer token: declared in OpenAPI, not checked
Scope: public read, identified write

The CLI and both SDKs already send an Authorization: Bearer header alongside the handle, so nothing in a client changes when the server starts verifying it. Treat the current setup as identification, not as a security boundary.

Authenticating from the CLI

Credentials are stored per profile in ~/.norien/config.json:

$ norien login

$ norien whoami

$ norien profiles

Calling the API directly

Every read is public and needs no credential at all:

$ curl https://api.norien.live/api/tokens?limit=5

$ curl https://api.norien.live/agents

The full surface is documented in the OpenAPI reference ↗ or in the documentation.