Authentication & API Keys

Two route groups cover authentication: auth validates credentials and signs messages, and user.apiKeys manages your API keys programmatically. Both are served by the Client Manager.

For how to obtain an API key in the dashboard, see the Get API Key guide. For wallet-based authentication, see Wallet Authentication. For what a key is allowed to do, see Permissions (Scopes).

`auth`

import { function createNosanaClient(network: NosanaNetwork | undefined, customConfig: PartialClientConfig & {
    connect: ConnectFactoryConfig & {
        clientSecret: string;
    };
}): NosanaClient & {
    connect: ServerConnect;
} (+3 overloads)createNosanaClient, type NosanaNetwork = "mainnet" | "devnet" | "localnet"
const NosanaNetwork: {
    readonly MAINNET: "mainnet";
    readonly DEVNET: "devnet";
    readonly LOCALNET: "localnet";
}NosanaNetwork } from '@nosana/kit';

const const client: NosanaClientclient = function createNosanaClient(network?: NosanaNetwork, customConfig?: PartialClientConfig): NosanaClient (+3 overloads)createNosanaClient(const NosanaNetwork: {
    readonly MAINNET: "mainnet";
    readonly DEVNET: "devnet";
    readonly LOCALNET: "localnet";
}NosanaNetwork.type MAINNET: "mainnet"MAINNET, {
  PartialClientConfig.api?: Partial<APIConfig> | undefinedapi: { apiKey?: string | undefinedapiKey: const process: {
    env: Record<string, string>;
}process.env: Record<string, string>env.stringNOSANA_API_KEY },
});

// Validate an API key
const const result: {
    valid: boolean;
    user?: {
        id: string;
        legacyUserId: (string | null) | null;
        email: string;
        name: (string | null) | null;
        provider: (string | null) | null;
        providerUsername: (string | null) | null;
        generatedAddress: string;
        created_at: ((Record<string, never> | string | number) | null) | null;
    };
    apiKeyId?: string;
    scopes?: string[];
}result = await const client: NosanaClientclient.NosanaClient.api: NosanaApiClientapi.auth: NosanaAuthApiauth.validateApiKey: (apiKey: string) => Promise<ValidateApiKeyResponse>validateApiKey('nos_xxx_your_api_key');

// Validate a SuperTokens session (optionally pass the cookie header)
const const session: {
    valid: boolean;
    user?: {
        id: string;
        supertokensUserId: (string | null) | null;
        legacyUserId: (string | null) | null;
        email: string;
        name: (string | null) | null;
        provider: (string | null) | null;
        providerUsername: (string | null) | null;
        generatedAddress: string;
        authenticationHeader: string;
        systemApiKey: string;
        created_at: ((Record<string, never> | string | number) | null) | null;
    };
    session?: {
        handle?: string;
        expiresAt?: string;
    };
}session = await const client: NosanaClientclient.NosanaClient.api: NosanaApiClientapi.auth: NosanaAuthApiauth.validateSession: (cookieHeader?: string) => Promise<ValidateSessionResponse>validateSession();

// Sign a message for external-service authentication
const const signature: stringsignature = await const client: NosanaClientclient.NosanaClient.api: NosanaApiClientapi.auth: NosanaAuthApiauth.signMessage: (message: string, options?: {
    includeTime?: boolean;
}) => Promise<string>signMessage('message-to-sign', {
  includeTime?: boolean | undefinedincludeTime: true, // optional: include a timestamp in the signed payload
});

Method	HTTP	Path	Description
`auth.validateApiKey(apiKey)`	POST	`/auth/validate-api-key`	Validate an API key, and see its permissions (`scopes`)
`auth.validateSession(cookieHeader?)`	POST	`/auth/validate-session`	Validate a SuperTokens session
`auth.signMessage(message, options?)`	POST	`/auth/sign-message/external`	Sign a message for external-service auth

`user.apiKeys`

Create, list, update, and delete API keys:

// Create a key — the plaintext key is only returned once, store it safely
const const created: {
    llmModels: (string[] | null) | null;
    key: string;
    id: string;
    name: string;
    status: string;
    scopes: string[];
    expiresAt: (string | null) | null;
    createdAt: string;
}created = await const client: NosanaClientclient.NosanaClient.api: NosanaApiClientapi.user: NosanaUserApiuser.NosanaUserApi.apiKeys: {
    create: (request: CreateApiKeyRequest) => Promise<ApiKeyCreated>;
    list: () => Promise<{
        keys: ApiKey[];
        total: number;
    }>;
    get: (id: string) => Promise<ApiKey>;
    update: (id: string, request: UpdateApiKeyRequest) => Promise<ApiKey>;
    delete: (id: string) => Promise<{
        success: boolean;
    }>;
}apiKeys.create: (request: CreateApiKeyRequest) => Promise<ApiKeyCreated>create({
  name: string@descriptionA descriptive name for the API key.name: 'ci-pipeline',
});
var console: ConsoleThe `console` module provides a simple debugging console that is similar to the
JavaScript console mechanism provided by web browsers.

The module exports two specific components:

* A `Console` class with methods such as `console.log()`, `console.error()` and `console.warn()` that can be used to write to any Node.js stream.
* A global `console` instance configured to write to [`process.stdout`](https://nodejs.org/docs/latest-v24.x/api/process.html#processstdout) and
[`process.stderr`](https://nodejs.org/docs/latest-v24.x/api/process.html#processstderr). The global `console` can be used without importing the `node:console` module.

_**Warning**_: The global console object's methods are neither consistently
synchronous like the browser APIs they resemble, nor are they consistently
asynchronous like all other Node.js streams. See the [`note on process I/O`](https://nodejs.org/docs/latest-v24.x/api/process.html#a-note-on-process-io) for
more information.

Example using the global `console`:

```js
console.log('hello world');
// Prints: hello world, to stdout
console.log('hello %s', 'world');
// Prints: hello world, to stdout
console.error(new Error('Whoops, something bad happened'));
// Prints error message and stack trace to stderr:
//   Error: Whoops, something bad happened
//     at [eval]:5:15
//     at Script.runInThisContext (node:vm:132:18)
//     at Object.runInThisContext (node:vm:309:38)
//     at node:internal/process/execution:77:19
//     at [eval]-wrapper:6:22
//     at evalScript (node:internal/process/execution:76:60)
//     at node:internal/main/eval_string:23:3

const name = 'Will Robinson';
console.warn(`Danger ${name}! Danger!`);
// Prints: Danger Will Robinson! Danger!, to stderr
```

Example using the `Console` class:

```js
const out = getStreamSomehow();
const err = getStreamSomehow();
const myConsole = new console.Console(out, err);

myConsole.log('hello world');
// Prints: hello world, to out
myConsole.log('hello %s', 'world');
// Prints: hello world, to out
myConsole.error(new Error('Whoops, something bad happened'));
// Prints: [Error: Whoops, something bad happened], to err

const name = 'Will Robinson';
myConsole.warn(`Danger ${name}! Danger!`);
// Prints: Danger Will Robinson! Danger!, to err
```
@see[source](https://github.com/nodejs/node/blob/v24.x/lib/console.js)console.Console.log(message?: any, ...optionalParams: any[]): void (+1 overload)Prints to `stdout` with newline. Multiple arguments can be passed, with the
first used as the primary message and all additional used as substitution
values similar to [`printf(3)`](http://man7.org/linux/man-pages/man3/printf.3.html)
(the arguments are all passed to [`util.format()`](https://nodejs.org/docs/latest-v24.x/api/util.html#utilformatformat-args)).

```js
const count = 5;
console.log('count: %d', count);
// Prints: count: 5, to stdout
console.log('count:', count);
// Prints: count: 5, to stdout
```

See [`util.format()`](https://nodejs.org/docs/latest-v24.x/api/util.html#utilformatformat-args) for more information.
@sincev0.1.100log('New key:', const created: {
    llmModels: (string[] | null) | null;
    key: string;
    id: string;
    name: string;
    status: string;
    scopes: string[];
    expiresAt: (string | null) | null;
    createdAt: string;
}created.key: string@descriptionThe full API key.key);

// List your keys
const { const keys: {
    llmModels: (string[] | null) | null;
    id: string;
    name: string;
    key: string;
    status: string;
    scopes: string[];
    lastUsedAt: (string | null) | null;
    expiresAt: (string | null) | null;
    createdAt: string;
    updatedAt: string;
}[]keys, const total: numbertotal } = await const client: NosanaClientclient.NosanaClient.api: NosanaApiClientapi.user: NosanaUserApiuser.NosanaUserApi.apiKeys: {
    create: (request: CreateApiKeyRequest) => Promise<ApiKeyCreated>;
    list: () => Promise<{
        keys: ApiKey[];
        total: number;
    }>;
    get: (id: string) => Promise<ApiKey>;
    update: (id: string, request: UpdateApiKeyRequest) => Promise<ApiKey>;
    delete: (id: string) => Promise<{
        success: boolean;
    }>;
}apiKeys.list: () => Promise<{
    keys: ApiKey[];
    total: number;
}>list();

// Get, update, delete by id
const const key: {
    llmModels: (string[] | null) | null;
    id: string;
    name: string;
    key: string;
    status: string;
    scopes: string[];
    lastUsedAt: (string | null) | null;
    expiresAt: (string | null) | null;
    createdAt: string;
    updatedAt: string;
}key = await const client: NosanaClientclient.NosanaClient.api: NosanaApiClientapi.user: NosanaUserApiuser.NosanaUserApi.apiKeys: {
    create: (request: CreateApiKeyRequest) => Promise<ApiKeyCreated>;
    list: () => Promise<{
        keys: ApiKey[];
        total: number;
    }>;
    get: (id: string) => Promise<ApiKey>;
    update: (id: string, request: UpdateApiKeyRequest) => Promise<ApiKey>;
    delete: (id: string) => Promise<{
        success: boolean;
    }>;
}apiKeys.get: (id: string) => Promise<ApiKey>get(const keys: {
    llmModels: (string[] | null) | null;
    id: string;
    name: string;
    key: string;
    status: string;
    scopes: string[];
    lastUsedAt: (string | null) | null;
    expiresAt: (string | null) | null;
    createdAt: string;
    updatedAt: string;
}[]keys[0].id: stringid);
await const client: NosanaClientclient.NosanaClient.api: NosanaApiClientapi.user: NosanaUserApiuser.NosanaUserApi.apiKeys: {
    create: (request: CreateApiKeyRequest) => Promise<ApiKeyCreated>;
    list: () => Promise<{
        keys: ApiKey[];
        total: number;
    }>;
    get: (id: string) => Promise<ApiKey>;
    update: (id: string, request: UpdateApiKeyRequest) => Promise<ApiKey>;
    delete: (id: string) => Promise<{
        success: boolean;
    }>;
}apiKeys.update: (id: string, request: UpdateApiKeyRequest) => Promise<ApiKey>update(const key: {
    llmModels: (string[] | null) | null;
    id: string;
    name: string;
    key: string;
    status: string;
    scopes: string[];
    lastUsedAt: (string | null) | null;
    expiresAt: (string | null) | null;
    createdAt: string;
    updatedAt: string;
}key.id: stringid, { name?: string | undefined@descriptionUpdate the key name.name: 'renamed-key' });
await const client: NosanaClientclient.NosanaClient.api: NosanaApiClientapi.user: NosanaUserApiuser.NosanaUserApi.apiKeys: {
    create: (request: CreateApiKeyRequest) => Promise<ApiKeyCreated>;
    list: () => Promise<{
        keys: ApiKey[];
        total: number;
    }>;
    get: (id: string) => Promise<ApiKey>;
    update: (id: string, request: UpdateApiKeyRequest) => Promise<ApiKey>;
    delete: (id: string) => Promise<{
        success: boolean;
    }>;
}apiKeys.delete: (id: string) => Promise<{
    success: boolean;
}>delete(const key: {
    llmModels: (string[] | null) | null;
    id: string;
    name: string;
    key: string;
    status: string;
    scopes: string[];
    lastUsedAt: (string | null) | null;
    expiresAt: (string | null) | null;
    createdAt: string;
    updatedAt: string;
}key.id: stringid);

Method	HTTP	Path	Description
`user.apiKeys.create(request)`	POST	`/api-keys/`	Create an API key
`user.apiKeys.list()`	GET	`/api-keys/`	List your API keys
`user.apiKeys.get(id)`	GET	`/api-keys/{id}`	Get an API key
`user.apiKeys.update(id, request)`	POST	`/api-keys/{id}/update`	Update an API key
`user.apiKeys.delete(id)`	POST	`/api-keys/{id}/delete`	Delete an API key

A new key gets every permission of the key that creates it, unless you pass scopes in the request to limit it. Permissions can't be changed after creation. See Permissions (Scopes).

Authentication & API Keys ​

auth ​

user.apiKeys ​

Authentication & API Keys

`auth`

`user.apiKeys`